[RFC,5/7] virtio: handle virtqueue_read_next_desc() errors

Stop processing the vring if an avail ring index is invalid.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/virtio/virtio.c | 47 +++++++++++++++++++++++++++++++++--------------
 1 file changed, 33 insertions(+), 14 deletions(-)

On Thu, 03/24 17:56, Stefan Hajnoczi wrote:
> Stop processing the vring if an avail ring index is invalid.
> 
> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
> ---
>  hw/virtio/virtio.c | 47 +++++++++++++++++++++++++++++++++--------------
>  1 file changed, 33 insertions(+), 14 deletions(-)
> 
> diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
> index 4758fe3..f845df2 100644
> --- a/hw/virtio/virtio.c
> +++ b/hw/virtio/virtio.c
> @@ -350,28 +350,33 @@ static unsigned int virtqueue_get_head(VirtQueue *vq, unsigned int idx)
>      return head;
>  }
>  
> -static unsigned virtqueue_read_next_desc(VirtIODevice *vdev, VRingDesc *desc,
> -                                         hwaddr desc_pa, unsigned int max)
> -{
> -    unsigned int next;
> +enum {
> +    VIRTQUEUE_READ_DESC_ERROR = -1,
> +    VIRTQUEUE_READ_DESC_DONE = 0,   /* end of chain */
> +    VIRTQUEUE_READ_DESC_MORE = 1,   /* more buffers in chain */
> +};
>  
> +static int virtqueue_read_next_desc(VirtIODevice *vdev, VRingDesc *desc,
> +                                    hwaddr desc_pa, unsigned int max,
> +                                    unsigned int *next)
> +{
>      /* If this descriptor says it doesn't chain, we're done. */
>      if (!(desc->flags & VRING_DESC_F_NEXT)) {
> -        return max;
> +        return VIRTQUEUE_READ_DESC_DONE;
>      }
>  
>      /* Check they're not leading us off end of descriptors. */
> -    next = desc->next;
> +    *next = desc->next;
>      /* Make sure compiler knows to grab that: we don't want it changing! */
>      smp_wmb();
>  
> -    if (next >= max) {
> -        error_report("Desc next is %u", next);
> -        exit(1);
> +    if (*next >= max) {
> +        virtio_error(vdev, "Desc next is %u", *next);
> +        return VIRTQUEUE_READ_DESC_ERROR;
>      }
>  
> -    vring_desc_read(vdev, desc, desc_pa, next);
> -    return next;
> +    vring_desc_read(vdev, desc, desc_pa, *next);
> +    return VIRTQUEUE_READ_DESC_MORE;
>  }
>  
>  void virtqueue_get_avail_bytes(VirtQueue *vq, unsigned int *in_bytes,
> @@ -380,6 +385,7 @@ void virtqueue_get_avail_bytes(VirtQueue *vq, unsigned int *in_bytes,
>  {
>      unsigned int idx;
>      unsigned int total_bufs, in_total, out_total;
> +    int rc;
>  
>      idx = vq->last_avail_idx;
>  
> @@ -389,7 +395,7 @@ void virtqueue_get_avail_bytes(VirtQueue *vq, unsigned int *in_bytes,
>          unsigned int max, num_bufs, indirect = 0;
>          VRingDesc desc;
>          hwaddr desc_pa;
> -        int i;
> +        unsigned int i;

This change seems a candicate for a separate patch, otherwise looks good to me!


>  
>          max = vq->vring.num;
>          num_bufs = total_bufs;
> @@ -432,7 +438,13 @@ void virtqueue_get_avail_bytes(VirtQueue *vq, unsigned int *in_bytes,
>              if (in_total >= max_in_bytes && out_total >= max_out_bytes) {
>                  goto done;
>              }
> -        } while ((i = virtqueue_read_next_desc(vdev, &desc, desc_pa, max)) != max);
> +
> +            rc = virtqueue_read_next_desc(vdev, &desc, desc_pa, max, &i);
> +        } while (rc == VIRTQUEUE_READ_DESC_MORE);
> +
> +        if (rc == VIRTQUEUE_READ_DESC_ERROR) {
> +            goto err;
> +        }
>  
>          if (!indirect)
>              total_bufs = num_bufs;
> @@ -584,6 +596,7 @@ void *virtqueue_pop(VirtQueue *vq, size_t sz)
>      hwaddr addr[VIRTQUEUE_MAX_SIZE];
>      struct iovec iov[VIRTQUEUE_MAX_SIZE];
>      VRingDesc desc;
> +    int rc;
>  
>      if (unlikely(vdev->broken)) {
>          return NULL;
> @@ -646,7 +659,13 @@ void *virtqueue_pop(VirtQueue *vq, size_t sz)
>              virtio_error(vdev, "Looped descriptor");
>              goto err_undo_map;
>          }
> -    } while ((i = virtqueue_read_next_desc(vdev, &desc, desc_pa, max)) != max);
> +
> +        rc = virtqueue_read_next_desc(vdev, &desc, desc_pa, max, &i);
> +    } while (rc == VIRTQUEUE_READ_DESC_MORE);
> +
> +    if (rc == VIRTQUEUE_READ_DESC_ERROR) {
> +        goto err_undo_map;
> +    }
>  
>      /* Now copy what we have collected and mapped */
>      elem = virtqueue_alloc_element(sz, out_num, in_num);
> -- 
> 2.5.5
>

On Fri, Mar 25, 2016 at 03:01:00PM +0800, Fam Zheng wrote:
> On Thu, 03/24 17:56, Stefan Hajnoczi wrote:
> > @@ -389,7 +395,7 @@ void virtqueue_get_avail_bytes(VirtQueue *vq, unsigned int *in_bytes,
> >          unsigned int max, num_bufs, indirect = 0;
> >          VRingDesc desc;
> >          hwaddr desc_pa;
> > -        int i;
> > +        unsigned int i;
> 
> This change seems a candicate for a separate patch, otherwise looks good to me!

Will fix in the next revision.