Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d78b519f authored by Brian Foley's avatar Brian Foley Committed by Rusty Russell
Browse files

virtio_mmio: Don't attempt to create empty virtqueues 



If a virtio device reports a QueueNumMax of 0, vring_new_virtqueue()
doesn't check this, and thanks to an unsigned (i < num - 1) loop
guard, scribbles over memory when initialising the free list.

Avoid by not trying to create zero-descriptor queues, as there's no
way to do any I/O with one.

Signed-off-by: default avatarBrian Foley <brian.foley@arm.com>
Signed-off-by: default avatarPawel Moll <pawel.moll@arm.com>
Signed-off-by: default avatarRusty Russell <rusty@rustcorp.com.au>
parent 3850d29f

drivers/virtio/virtio_mmio.c

+10 −0
Original line number Original line Diff line number Diff line
@@ -331,6 +331,16 @@ static struct virtqueue *vm_setup_vq(struct virtio_device *vdev, unsigned index, 
	 * and two rings (which makes it "alignment_size * 2")

	 * and two rings (which makes it "alignment_size * 2")

	 */

	 */

	info->num = readl(vm_dev->base + VIRTIO_MMIO_QUEUE_NUM_MAX);

	info->num = readl(vm_dev->base + VIRTIO_MMIO_QUEUE_NUM_MAX);



	/* If the device reports a 0 entry queue, we won't be able to

	 * use it to perform I/O, and vring_new_virtqueue() can't create

	 * empty queues anyway, so don't bother to set up the device.

	 */

	if (info->num == 0) {

		err = -ENOENT;

		goto error_alloc_pages;

	}



	while (1) {

	while (1) {

		size = PAGE_ALIGN(vring_size(info->num,

		size = PAGE_ALIGN(vring_size(info->num,

				VIRTIO_MMIO_VRING_ALIGN));

				VIRTIO_MMIO_VRING_ALIGN));