diff mbox

[RFC,5/7] virtio: handle virtqueue_read_next_desc() errors

Message ID 1458842214-11450-6-git-send-email-stefanha@redhat.com (mailing list archive)
State New, archived
Headers show

Commit Message

Stefan Hajnoczi March 24, 2016, 5:56 p.m. UTC 
Stop processing the vring if an avail ring index is invalid.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/virtio/virtio.c | 47 +++++++++++++++++++++++++++++++++--------------
 1 file changed, 33 insertions(+), 14 deletions(-)

Comments

Fam Zheng March 25, 2016, 7:01 a.m. UTC | #1 
On Thu, 03/24 17:56, Stefan Hajnoczi wrote:
> Stop processing the vring if an avail ring index is invalid.
> 
> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
> ---
>  hw/virtio/virtio.c | 47 +++++++++++++++++++++++++++++++++--------------
>  1 file changed, 33 insertions(+), 14 deletions(-)
> 
> diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
> index 4758fe3..f845df2 100644
> --- a/hw/virtio/virtio.c
> +++ b/hw/virtio/virtio.c
> @@ -350,28 +350,33 @@ static unsigned int virtqueue_get_head(VirtQueue *vq, unsigned int idx)
>      return head;
>  }
>  
> -static unsigned virtqueue_read_next_desc(VirtIODevice *vdev, VRingDesc *desc,
> -                                         hwaddr desc_pa, unsigned int max)
> -{
> -    unsigned int next;
> +enum {
> +    VIRTQUEUE_READ_DESC_ERROR = -1,
> +    VIRTQUEUE_READ_DESC_DONE = 0,   /* end of chain */
> +    VIRTQUEUE_READ_DESC_MORE = 1,   /* more buffers in chain */
> +};
>  
> +static int virtqueue_read_next_desc(VirtIODevice *vdev, VRingDesc *desc,
> +                                    hwaddr desc_pa, unsigned int max,
> +                                    unsigned int *next)
> +{
>      /* If this descriptor says it doesn't chain, we're done. */
>      if (!(desc->flags & VRING_DESC_F_NEXT)) {
> -        return max;
> +        return VIRTQUEUE_READ_DESC_DONE;
>      }
>  
>      /* Check they're not leading us off end of descriptors. */
> -    next = desc->next;
> +    *next = desc->next;
>      /* Make sure compiler knows to grab that: we don't want it changing! */
>      smp_wmb();
>  
> -    if (next >= max) {
> -        error_report("Desc next is %u", next);
> -        exit(1);
> +    if (*next >= max) {
> +        virtio_error(vdev, "Desc next is %u", *next);
> +        return VIRTQUEUE_READ_DESC_ERROR;
>      }
>  
> -    vring_desc_read(vdev, desc, desc_pa, next);
> -    return next;
> +    vring_desc_read(vdev, desc, desc_pa, *next);
> +    return VIRTQUEUE_READ_DESC_MORE;
>  }
>  
>  void virtqueue_get_avail_bytes(VirtQueue *vq, unsigned int *in_bytes,
> @@ -380,6 +385,7 @@ void virtqueue_get_avail_bytes(VirtQueue *vq, unsigned int *in_bytes,
>  {
>      unsigned int idx;
>      unsigned int total_bufs, in_total, out_total;
> +    int rc;
>  
>      idx = vq->last_avail_idx;
>  
> @@ -389,7 +395,7 @@ void virtqueue_get_avail_bytes(VirtQueue *vq, unsigned int *in_bytes,
>          unsigned int max, num_bufs, indirect = 0;
>          VRingDesc desc;
>          hwaddr desc_pa;
> -        int i;
> +        unsigned int i;

This change seems a candicate for a separate patch, otherwise looks good to me!


>  
>          max = vq->vring.num;
>          num_bufs = total_bufs;
> @@ -432,7 +438,13 @@ void virtqueue_get_avail_bytes(VirtQueue *vq, unsigned int *in_bytes,
>              if (in_total >= max_in_bytes && out_total >= max_out_bytes) {
>                  goto done;
>              }
> -        } while ((i = virtqueue_read_next_desc(vdev, &desc, desc_pa, max)) != max);
> +
> +            rc = virtqueue_read_next_desc(vdev, &desc, desc_pa, max, &i);
> +        } while (rc == VIRTQUEUE_READ_DESC_MORE);
> +
> +        if (rc == VIRTQUEUE_READ_DESC_ERROR) {
> +            goto err;
> +        }
>  
>          if (!indirect)
>              total_bufs = num_bufs;
> @@ -584,6 +596,7 @@ void *virtqueue_pop(VirtQueue *vq, size_t sz)
>      hwaddr addr[VIRTQUEUE_MAX_SIZE];
>      struct iovec iov[VIRTQUEUE_MAX_SIZE];
>      VRingDesc desc;
> +    int rc;
>  
>      if (unlikely(vdev->broken)) {
>          return NULL;
> @@ -646,7 +659,13 @@ void *virtqueue_pop(VirtQueue *vq, size_t sz)
>              virtio_error(vdev, "Looped descriptor");
>              goto err_undo_map;
>          }
> -    } while ((i = virtqueue_read_next_desc(vdev, &desc, desc_pa, max)) != max);
> +
> +        rc = virtqueue_read_next_desc(vdev, &desc, desc_pa, max, &i);
> +    } while (rc == VIRTQUEUE_READ_DESC_MORE);
> +
> +    if (rc == VIRTQUEUE_READ_DESC_ERROR) {
> +        goto err_undo_map;
> +    }
>  
>      /* Now copy what we have collected and mapped */
>      elem = virtqueue_alloc_element(sz, out_num, in_num);
> -- 
> 2.5.5
>
Stefan Hajnoczi March 29, 2016, 11:14 a.m. UTC | #2 
On Fri, Mar 25, 2016 at 03:01:00PM +0800, Fam Zheng wrote:
> On Thu, 03/24 17:56, Stefan Hajnoczi wrote:
> > @@ -389,7 +395,7 @@ void virtqueue_get_avail_bytes(VirtQueue *vq, unsigned int *in_bytes,
> >          unsigned int max, num_bufs, indirect = 0;
> >          VRingDesc desc;
> >          hwaddr desc_pa;
> > -        int i;
> > +        unsigned int i;
> 
> This change seems a candicate for a separate patch, otherwise looks good to me!

Will fix in the next revision.
diff mbox

Patch

diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index 4758fe3..f845df2 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -350,28 +350,33 @@  static unsigned int virtqueue_get_head(VirtQueue *vq, unsigned int idx)
     return head;
 }
 
-static unsigned virtqueue_read_next_desc(VirtIODevice *vdev, VRingDesc *desc,
-                                         hwaddr desc_pa, unsigned int max)
-{
-    unsigned int next;
+enum {
+    VIRTQUEUE_READ_DESC_ERROR = -1,
+    VIRTQUEUE_READ_DESC_DONE = 0,   /* end of chain */
+    VIRTQUEUE_READ_DESC_MORE = 1,   /* more buffers in chain */
+};
 
+static int virtqueue_read_next_desc(VirtIODevice *vdev, VRingDesc *desc,
+                                    hwaddr desc_pa, unsigned int max,
+                                    unsigned int *next)
+{
     /* If this descriptor says it doesn't chain, we're done. */
     if (!(desc->flags & VRING_DESC_F_NEXT)) {
-        return max;
+        return VIRTQUEUE_READ_DESC_DONE;
     }
 
     /* Check they're not leading us off end of descriptors. */
-    next = desc->next;
+    *next = desc->next;
     /* Make sure compiler knows to grab that: we don't want it changing! */
     smp_wmb();
 
-    if (next >= max) {
-        error_report("Desc next is %u", next);
-        exit(1);
+    if (*next >= max) {
+        virtio_error(vdev, "Desc next is %u", *next);
+        return VIRTQUEUE_READ_DESC_ERROR;
     }
 
-    vring_desc_read(vdev, desc, desc_pa, next);
-    return next;
+    vring_desc_read(vdev, desc, desc_pa, *next);
+    return VIRTQUEUE_READ_DESC_MORE;
 }
 
 void virtqueue_get_avail_bytes(VirtQueue *vq, unsigned int *in_bytes,
@@ -380,6 +385,7 @@  void virtqueue_get_avail_bytes(VirtQueue *vq, unsigned int *in_bytes,
 {
     unsigned int idx;
     unsigned int total_bufs, in_total, out_total;
+    int rc;
 
     idx = vq->last_avail_idx;
 
@@ -389,7 +395,7 @@  void virtqueue_get_avail_bytes(VirtQueue *vq, unsigned int *in_bytes,
         unsigned int max, num_bufs, indirect = 0;
         VRingDesc desc;
         hwaddr desc_pa;
-        int i;
+        unsigned int i;
 
         max = vq->vring.num;
         num_bufs = total_bufs;
@@ -432,7 +438,13 @@  void virtqueue_get_avail_bytes(VirtQueue *vq, unsigned int *in_bytes,
             if (in_total >= max_in_bytes && out_total >= max_out_bytes) {
                 goto done;
             }
-        } while ((i = virtqueue_read_next_desc(vdev, &desc, desc_pa, max)) != max);
+
+            rc = virtqueue_read_next_desc(vdev, &desc, desc_pa, max, &i);
+        } while (rc == VIRTQUEUE_READ_DESC_MORE);
+
+        if (rc == VIRTQUEUE_READ_DESC_ERROR) {
+            goto err;
+        }
 
         if (!indirect)
             total_bufs = num_bufs;
@@ -584,6 +596,7 @@  void *virtqueue_pop(VirtQueue *vq, size_t sz)
     hwaddr addr[VIRTQUEUE_MAX_SIZE];
     struct iovec iov[VIRTQUEUE_MAX_SIZE];
     VRingDesc desc;
+    int rc;
 
     if (unlikely(vdev->broken)) {
         return NULL;
@@ -646,7 +659,13 @@  void *virtqueue_pop(VirtQueue *vq, size_t sz)
             virtio_error(vdev, "Looped descriptor");
             goto err_undo_map;
         }
-    } while ((i = virtqueue_read_next_desc(vdev, &desc, desc_pa, max)) != max);
+
+        rc = virtqueue_read_next_desc(vdev, &desc, desc_pa, max, &i);
+    } while (rc == VIRTQUEUE_READ_DESC_MORE);
+
+    if (rc == VIRTQUEUE_READ_DESC_ERROR) {
+        goto err_undo_map;
+    }
 
     /* Now copy what we have collected and mapped */
     elem = virtqueue_alloc_element(sz, out_num, in_num);