On Wed, 21 Sep 2016 18:57:12 +0200 Greg Kurz <gr...@kaod.org> wrote: > A broken guest may send a request with only non-empty out buffers > or only non-empty in buffers, virtqueue_pop() will then return a > VirtQueueElement with out_num == 0 or in_num == 0 respectively. > > All 9P requests are expected to start with the following 7-byte header: > > uint32_t size_le; > uint8_t id; > uint16_t tag_le; > > If iov_to_buf() fails to return these 7 bytes, then something is wrong in > the guest. > > In both cases, it is wrong to crash QEMU, since the root cause lies in the > guest. Let's switch the device to the broken state instead. > > Signed-off-by: Greg Kurz <gr...@kaod.org> > --- > v2: - added out_free_pdu: label for errors or when virtqueue is empty > --- > hw/9pfs/virtio-9p-device.c | 20 ++++++++++++++++---- > 1 file changed, 16 insertions(+), 4 deletions(-)
Reviewed-by: Cornelia Huck <cornelia.h...@de.ibm.com>
