virtio_mmio: Don't attempt to create empty virtqueues (d78b519f) · Commits · 戴 / test

If a virtio device reports a QueueNumMax of 0, vring_new_virtqueue() doesn't check this, and thanks to an unsigned (i < num - 1) loop guard, scribbles over memory when initialising the free list. Avoid by not trying to create zero-descriptor queues, as there's no way to do any I/O with one. Signed-off-by:

Brian Foley <brian.foley@arm.com> Signed-off-by:

Pawel Moll <pawel.moll@arm.com> Signed-off-by:

Rusty Russell <rusty@rustcorp.com.au>

drivers/virtio/virtio_mmio.c

+10 −0

Original line number	Diff line number	Diff line
		@@ -331,6 +331,16 @@ static struct virtqueue vm_setup_vq(struct virtio_device vdev, unsigned index,
		* and two rings (which makes it "alignment_size * 2")
		*/
		info->num = readl(vm_dev->base + VIRTIO_MMIO_QUEUE_NUM_MAX);

		/* If the device reports a 0 entry queue, we won't be able to
		* use it to perform I/O, and vring_new_virtqueue() can't create
		* empty queues anyway, so don't bother to set up the device.
		*/
		if (info->num == 0) {
		err = -ENOENT;
		goto error_alloc_pages;
		}

		while (1) {
		size = PAGE_ALIGN(vring_size(info->num,
		VIRTIO_MMIO_VRING_ALIGN));

Admin message