From ce317461573bac12b10d67699b4ddf1f97cf066c Mon Sep 17 00:00:00 2001 From: Jason Wang Date: Fri, 25 Sep 2015 13:21:28 +0800 Subject: [PATCH] virtio: introduce virtqueue_unmap_sg() Factor out sg unmapping logic. This will be reused by the patch that can discard descriptor. Cc: Michael S. Tsirkin Cc: Andrew James Signed-off-by: Jason Wang Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin Upstream-Status: Backport git.qemu.org/?p=qemu.git;a=commit;h=ce317461573bac12b10d67699b4ddf1f97cf066c CVE: CVE-2015-7295 patch #1 [Yocto # 9013] Signed-off-by: Armin Kuster --- hw/virtio/virtio.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) Index: qemu-2.4.0/hw/virtio/virtio.c =================================================================== --- qemu-2.4.0.orig/hw/virtio/virtio.c +++ qemu-2.4.0/hw/virtio/virtio.c @@ -243,14 +243,12 @@ int virtio_queue_empty(VirtQueue *vq) return vring_avail_idx(vq) == vq->last_avail_idx; } -void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem, - unsigned int len, unsigned int idx) +static void virtqueue_unmap_sg(VirtQueue *vq, const VirtQueueElement *elem, + unsigned int len) { unsigned int offset; int i; - trace_virtqueue_fill(vq, elem, len, idx); - offset = 0; for (i = 0; i < elem->in_num; i++) { size_t size = MIN(len - offset, elem->in_sg[i].iov_len); @@ -266,6 +264,14 @@ void virtqueue_fill(VirtQueue *vq, const cpu_physical_memory_unmap(elem->out_sg[i].iov_base, elem->out_sg[i].iov_len, 0, elem->out_sg[i].iov_len); +} + +void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem, + unsigned int len, unsigned int idx) +{ + trace_virtqueue_fill(vq, elem, len, idx); + + virtqueue_unmap_sg(vq, elem, len); idx = (idx + vring_used_idx(vq)) % vq->vring.num;