If the vring is invalid, tell the caller no bytes are available and mark
the device broken.
Signed-off-by: Stefan Hajnoczi
---
hw/virtio/virtio.c | 17 +++--
1 file changed, 11 insertions(+), 6 deletions(-)
diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index 0c0d333..48f759e 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -402,14 +402,14 @@ void virtqueue_get_avail_bytes(VirtQueue *vq, unsigned
int *in_bytes,
if (desc.flags & VRING_DESC_F_INDIRECT) {
if (desc.len % sizeof(VRingDesc)) {
-error_report("Invalid size for indirect buffer table");
-exit(1);
+virtio_error(vdev, "Invalid size for indirect buffer table");
+goto err;
}
/* If we've got too many, that implies a descriptor loop. */
if (num_bufs >= max) {
-error_report("Looped descriptor");
-exit(1);
+virtio_error(vdev, "Looped descriptor");
+goto err;
}
/* loop over the indirect descriptor table */
@@ -423,8 +423,8 @@ void virtqueue_get_avail_bytes(VirtQueue *vq, unsigned int
*in_bytes,
do {
/* If we've got too many, that implies a descriptor loop. */
if (++num_bufs > max) {
-error_report("Looped descriptor");
-exit(1);
+virtio_error(vdev, "Looped descriptor");
+goto err;
}
if (desc.flags & VRING_DESC_F_WRITE) {
@@ -449,6 +449,11 @@ done:
if (out_bytes) {
*out_bytes = out_total;
}
+return;
+
+err:
+in_total = out_total = 0;
+goto done;
}
int virtqueue_avail_bytes(VirtQueue *vq, unsigned int in_bytes,
--
2.5.5