From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:34587) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1X0bX4-0005Ze-Lo for qemu-devel@nongnu.org; Fri, 27 Jun 2014 15:10:04 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1X0bWx-00070Q-KF for qemu-devel@nongnu.org; Fri, 27 Jun 2014 15:09:58 -0400 Received: from mx1.redhat.com ([209.132.183.28]:15041) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1X0bWx-00070E-B3 for qemu-devel@nongnu.org; Fri, 27 Jun 2014 15:09:51 -0400 Received: from int-mx13.intmail.prod.int.phx2.redhat.com (int-mx13.intmail.prod.int.phx2.redhat.com [10.5.11.26]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id s5RJ9o4n003329 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Fri, 27 Jun 2014 15:09:50 -0400 From: Kevin Wolf Date: Fri, 27 Jun 2014 21:08:48 +0200 Message-Id: <1403896146-3063-30-git-send-email-kwolf@redhat.com> In-Reply-To: <1403896146-3063-1-git-send-email-kwolf@redhat.com> References: <1403896146-3063-1-git-send-email-kwolf@redhat.com> Subject: [Qemu-devel] [PULL 29/47] virtio-blk: Fix and clean up the in_sg and out_sg check List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: kwolf@redhat.com From: Fam Zheng out_sg is checked by iov_to_buf below, so it can be dropped. Add assert and iov_discard_back around in_sg, as the in_sg is handled in dataplane code. Signed-off-by: Fam Zheng Reviewed-by: Stefan Hajnoczi Signed-off-by: Kevin Wolf --- hw/block/virtio-blk.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c index 0561095..4b1aeab 100644 --- a/hw/block/virtio-blk.c +++ b/hw/block/virtio-blk.c @@ -345,7 +345,9 @@ static void virtio_blk_handle_request(VirtIOBlockReq *req, MultiReqBuffer *mrb) { uint32_t type; + struct iovec *in_iov = req->elem->in_sg; struct iovec *iov = req->elem->out_sg; + unsigned in_num = req->elem->in_num; unsigned out_num = req->elem->out_num; if (req->elem->out_num < 1 || req->elem->in_num < 1) { @@ -353,19 +355,24 @@ static void virtio_blk_handle_request(VirtIOBlockReq *req, exit(1); } - if (req->elem->out_sg[0].iov_len < sizeof(req->out) || - req->elem->in_sg[req->elem->in_num - 1].iov_len < sizeof(*req->in)) { - error_report("virtio-blk header not in correct element"); - exit(1); - } - if (unlikely(iov_to_buf(iov, out_num, 0, &req->out, sizeof(req->out)) != sizeof(req->out))) { error_report("virtio-blk request outhdr too short"); exit(1); } + iov_discard_front(&iov, &out_num, sizeof(req->out)); - req->in = (void *)req->elem->in_sg[req->elem->in_num - 1].iov_base; + + if (in_num < 1 || + in_iov[in_num - 1].iov_len < sizeof(struct virtio_blk_inhdr)) { + error_report("virtio-blk request inhdr too short"); + exit(1); + } + + req->in = (void *)in_iov[in_num - 1].iov_base + + in_iov[in_num - 1].iov_len + - sizeof(struct virtio_blk_inhdr); + iov_discard_back(in_iov, &in_num, sizeof(struct virtio_blk_inhdr)); type = ldl_p(&req->out.type); -- 1.8.3.1