Re: [PATCH 7/8] 9pfs/xen: implement response_buffer_size callback

[Christian Schoenebeck <qemu_oss@crudebyte.com>]

On Friday, 12 June 2026 02:23:15 CEST Stefano Stabellini wrote:
> On Wed, 27 May 2026, Christian Schoenebeck wrote:
> > Add and implement the response_buffer_size callback for the Xen
> > transport.
> > 
> > Returns the size of the response buffer from the rings in_sg, as limit
> > for 9p server while generating a response for supplied PDU.
> > 
> > Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
> > ---
> > 
> >  hw/9pfs/xen-9p-backend.c | 11 +++++++++++
[...]
> > +static size_t xen_9pfs_response_buffer_size(V9fsPDU *pdu)
> > +{
> > +    Xen9pfsDev *priv = container_of(pdu->s, Xen9pfsDev, state);
> > +    Xen9pfsRing *ring = &priv->rings[pdu->tag % priv->num_rings];
> > +    int num;
> > +
> > +    xen_9pfs_in_sg(ring, ring->sg, &num, pdu->idx, 0);
> > +    return iov_size(ring->sg, num);
> > +}
> 
> xen_9pfs_init_out_iov_from_pdu and xen_9pfs_init_in_iov_from_pdu
> allocate ring->sg, but it would seem xen_9pfs_response_buffer_size could
> be called before xen_9pfs_init_out_iov_from_pdu and
> xen_9pfs_init_in_iov_from_pdu, therefore ring->sg could be NULL here.
> 
> If we do it this way, we avoid the NULL dereference.
> 
>    struct iovec in_sg[2];
> 
>    xen_9pfs_in_sg(ring, in_sg, &num, pdu->idx, 0);
>    return iov_size(in_sg, num);

Good catch!

/Christian