falso
/
qemu-irix
mirror of https://github.com/n64decomp/qemu-irix.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

virtio-blk: Fix and clean up the in_sg and out_sg check 

out_sg is checked by iov_to_buf below, so it can be dropped.

Add assert and iov_discard_back around in_sg, as the in_sg is handled in
dataplane code.

Signed-off-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
This commit is contained in:
Fam Zheng 2014-06-11 12:11:50 +08:00 committed by Kevin Wolf
parent ab2e3cd2dc
commit ee17e84830
1 changed files with 14 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
hw/block/virtio-blk.c
View File

@ -345,7 +345,9 @@ static void virtio_blk_handle_request(VirtIOBlockReq *req,
MultiReqBuffer *mrb) MultiReqBuffer *mrb)
{ {
uint32_t type; uint32_t type;
struct iovec *in_iov = req->elem->in_sg;
struct iovec *iov = req->elem->out_sg; struct iovec *iov = req->elem->out_sg;
unsigned in_num = req->elem->in_num;
unsigned out_num = req->elem->out_num; unsigned out_num = req->elem->out_num;
if (req->elem->out_num < 1 || req->elem->in_num < 1) { if (req->elem->out_num < 1 || req->elem->in_num < 1) {
@ -353,19 +355,24 @@ static void virtio_blk_handle_request(VirtIOBlockReq *req,
exit(1); exit(1);
} }
if (req->elem->out_sg[0].iov_len < sizeof(req->out) ||
req->elem->in_sg[req->elem->in_num - 1].iov_len < sizeof(*req->in)) {
error_report("virtio-blk header not in correct element");
exit(1);
}
if (unlikely(iov_to_buf(iov, out_num, 0, &req->out, if (unlikely(iov_to_buf(iov, out_num, 0, &req->out,
sizeof(req->out)) != sizeof(req->out))) { sizeof(req->out)) != sizeof(req->out))) {
error_report("virtio-blk request outhdr too short"); error_report("virtio-blk request outhdr too short");
exit(1); exit(1);
} }
iov_discard_front(&iov, &out_num, sizeof(req->out)); iov_discard_front(&iov, &out_num, sizeof(req->out));
req->in = (void *)req->elem->in_sg[req->elem->in_num - 1].iov_base;
if (in_num < 1 ||
in_iov[in_num - 1].iov_len < sizeof(struct virtio_blk_inhdr)) {
error_report("virtio-blk request inhdr too short");
exit(1);
}
req->in = (void *)in_iov[in_num - 1].iov_base
+ in_iov[in_num - 1].iov_len
- sizeof(struct virtio_blk_inhdr);
iov_discard_back(in_iov, &in_num, sizeof(struct virtio_blk_inhdr));
type = ldl_p(&req->out.type); type = ldl_p(&req->out.type);