[Qemu-devel] [PATCH 1/2] virtio: make it clear that "len" for a used descriptor is len written.

[Rusty Russell]

And enforce this with a check that it's <= the writable length.

Signed-off-by: Rusty Russell <ru...@rustcorp.com.au>
---
 hw/virtio/virtio.c         | 19 ++++++++++++-------
 include/hw/virtio/virtio.h |  4 ++--
 2 files changed, 14 insertions(+), 9 deletions(-)

diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index 882a31b..c944113 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -243,16 +243,21 @@ int virtio_queue_empty(VirtQueue *vq)
 }
 
 void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem,
-                    unsigned int len, unsigned int idx)
+                    unsigned int len_written, unsigned int idx)
 {
-    unsigned int offset;
+    unsigned int offset, tot_wlen;
     int i;
 
-    trace_virtqueue_fill(vq, elem, len, idx);
+    trace_virtqueue_fill(vq, elem, len_written, idx);
+
+    for (tot_wlen = i = 0; i < elem->in_num; i++) {
+        tot_wlen += elem->in_sg[i].iov_len;
+    }
+    assert(len_written <= tot_wlen);
 
     offset = 0;
     for (i = 0; i < elem->in_num; i++) {
-        size_t size = MIN(len - offset, elem->in_sg[i].iov_len);
+        size_t size = MIN(len_written - offset, elem->in_sg[i].iov_len);
 
         cpu_physical_memory_unmap(elem->in_sg[i].iov_base,
                                   elem->in_sg[i].iov_len,
@@ -270,7 +275,7 @@ void virtqueue_fill(VirtQueue *vq, const VirtQueueElement 
*elem,
 
     /* Get a pointer to the next entry in the used ring. */
     vring_used_ring_id(vq, idx, elem->index);
-    vring_used_ring_len(vq, idx, len);
+    vring_used_ring_len(vq, idx, len_written);
 }
 
 void virtqueue_flush(VirtQueue *vq, unsigned int count)
@@ -288,9 +293,9 @@ void virtqueue_flush(VirtQueue *vq, unsigned int count)
 }
 
 void virtqueue_push(VirtQueue *vq, const VirtQueueElement *elem,
-                    unsigned int len)
+                    unsigned int len_written)
 {
-    virtqueue_fill(vq, elem, len, 0);
+    virtqueue_fill(vq, elem, len_written, 0);
     virtqueue_flush(vq, 1);
 }
 
diff --git a/include/hw/virtio/virtio.h b/include/hw/virtio/virtio.h
index df09993..153374f 100644
--- a/include/hw/virtio/virtio.h
+++ b/include/hw/virtio/virtio.h
@@ -191,10 +191,10 @@ VirtQueue *virtio_add_queue(VirtIODevice *vdev, int 
queue_size,
 void virtio_del_queue(VirtIODevice *vdev, int n);
 
 void virtqueue_push(VirtQueue *vq, const VirtQueueElement *elem,
-                    unsigned int len);
+                    unsigned int len_written);
 void virtqueue_flush(VirtQueue *vq, unsigned int count);
 void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem,
-                    unsigned int len, unsigned int idx);
+                    unsigned int len_written, unsigned int idx);
 
 void virtqueue_map_sg(struct iovec *sg, hwaddr *addr,
     size_t num_sg, int is_write);
-- 
2.1.0