31
31
#include <stdio.h>
32
32
#include <stdlib.h>
33
33
#include <string.h>
34
- #include <assert.h>
35
34
#include <pthread.h>
36
35
#include <openssl/md5.h>
37
36
@@ -219,6 +218,15 @@ virtio_blk_done(struct blockif_req *br, int err)
219
218
pthread_mutex_unlock (& blk -> mtx );
220
219
}
221
220
221
+ static void
222
+ virtio_blk_abort (struct virtio_vq_info * vq , uint16_t idx )
223
+ {
224
+ if (idx < vq -> qsize ) {
225
+ vq_relchain (vq , idx , 1 );
226
+ vq_endchains (vq , 0 );
227
+ }
228
+ }
229
+
222
230
static void
223
231
virtio_blk_proc (struct virtio_blk * blk , struct virtio_vq_info * vq )
224
232
{
@@ -231,6 +239,7 @@ virtio_blk_proc(struct virtio_blk *blk, struct virtio_vq_info *vq)
231
239
struct iovec iov [BLOCKIF_IOV_MAX + 2 ];
232
240
uint16_t idx , flags [BLOCKIF_IOV_MAX + 2 ];
233
241
242
+ idx = vq -> qsize ;
234
243
n = vq_getchain (vq , & idx , iov , BLOCKIF_IOV_MAX + 2 , flags );
235
244
236
245
/*
@@ -241,18 +250,36 @@ virtio_blk_proc(struct virtio_blk *blk, struct virtio_vq_info *vq)
241
250
* XXX - note - this fails on crash dump, which does a
242
251
* VIRTIO_BLK_T_FLUSH with a zero transfer length
243
252
*/
244
- assert (n >= 2 && n <= BLOCKIF_IOV_MAX + 2 );
253
+ if (n < 2 || n > BLOCKIF_IOV_MAX + 2 ) {
254
+ WPRINTF (("%s: vq_getchain failed\n" , __func__ ));
255
+ virtio_blk_abort (vq , idx );
256
+ return ;
257
+ }
245
258
246
259
io = & blk -> ios [idx ];
247
- assert ((flags [0 ] & VRING_DESC_F_WRITE ) == 0 );
248
- assert (iov [0 ].iov_len == sizeof (struct virtio_blk_hdr ));
260
+ if ((flags [0 ] & VRING_DESC_F_WRITE ) != 0 ) {
261
+ WPRINTF (("%s: the type for hdr should not be VRING_DESC_F_WRITE\n" , __func__ ));
262
+ virtio_blk_abort (vq , idx );
263
+ return ;
264
+ }
265
+ if (iov [0 ].iov_len != sizeof (struct virtio_blk_hdr )) {
266
+ WPRINTF (("%s: the size for hdr %ld should be %ld \n" ,
267
+ __func__ ,
268
+ iov [0 ].iov_len ,
269
+ sizeof (struct virtio_blk_hdr )));
270
+ virtio_blk_abort (vq , idx );
271
+ return ;
272
+ }
249
273
vbh = iov [0 ].iov_base ;
250
274
memcpy (& io -> req .iov , & iov [1 ], sizeof (struct iovec ) * (n - 2 ));
251
275
io -> req .iovcnt = n - 2 ;
252
276
io -> req .offset = vbh -> sector * DEV_BSIZE ;
253
277
io -> status = iov [-- n ].iov_base ;
254
- assert (iov [n ].iov_len == 1 );
255
- assert (flags [n ] & VRING_DESC_F_WRITE );
278
+ if (iov [n ].iov_len != 1 || ((flags [n ] & VRING_DESC_F_WRITE ) == 0 )) {
279
+ WPRINTF (("%s: status iov is invalid!\n" , __func__ ));
280
+ virtio_blk_abort (vq , idx );
281
+ return ;
282
+ }
256
283
257
284
/*
258
285
* XXX
@@ -283,7 +310,11 @@ virtio_blk_proc(struct virtio_blk *blk, struct virtio_vq_info *vq)
283
310
* therefore test the inverse of the descriptor bit
284
311
* to the op.
285
312
*/
286
- assert (((flags [i ] & VRING_DESC_F_WRITE ) == 0 ) == writeop );
313
+ if (((flags [i ] & VRING_DESC_F_WRITE ) == 0 ) != writeop ) {
314
+ WPRINTF (("%s: flag is confict with operation\n" , __func__ ));
315
+ virtio_blk_done (& io -> req , EINVAL );
316
+ return ;
317
+ }
287
318
iolen += iov [i ].iov_len ;
288
319
}
289
320
io -> req .resid = iolen ;
@@ -337,7 +368,8 @@ virtio_blk_proc(struct virtio_blk *blk, struct virtio_vq_info *vq)
337
368
virtio_blk_done (& io -> req , EOPNOTSUPP );
338
369
return ;
339
370
}
340
- assert (err == 0 );
371
+ if (err )
372
+ WPRINTF (("%s: request process failed\n" , __func__ ));
341
373
}
342
374
343
375
static void
0 commit comments