Improve vhost_get_avail_head() so that the head or errno is returned. With it, the relevant sanity checks are squeezed to vhost_get_avail_head() and vhost_get_vq_desc() is further simplified. No functional change intended. Signed-off-by: Gavin Shan <gshan@xxxxxxxxxx> --- drivers/vhost/vhost.c | 50 ++++++++++++++++++++++--------------------- 1 file changed, 26 insertions(+), 24 deletions(-) diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c index b278c0333a66..4ddb9ec2fe46 100644 --- a/drivers/vhost/vhost.c +++ b/drivers/vhost/vhost.c @@ -1322,11 +1322,27 @@ static inline int vhost_get_avail_idx(struct vhost_virtqueue *vq) return 1; } -static inline int vhost_get_avail_head(struct vhost_virtqueue *vq, - __virtio16 *head, int idx) +static inline int vhost_get_avail_head(struct vhost_virtqueue *vq) { - return vhost_get_avail(vq, *head, - &vq->avail->ring[idx & (vq->num - 1)]); + __virtio16 head; + int r; + + r = vhost_get_avail(vq, head, + &vq->avail->ring[vq->last_avail_idx & (vq->num - 1)]); + if (unlikely(r)) { + vq_err(vq, "Failed to read head: index %u address %p\n", + vq->last_avail_idx, + &vq->avail->ring[vq->last_avail_idx & (vq->num - 1)]); + return r; + } + + r = vhost16_to_cpu(vq, head); + if (unlikely(r >= vq->num)) { + vq_err(vq, "Invalid head %d (%u)\n", r, vq->num); + return -EINVAL; + } + + return r; } static inline int vhost_get_avail_flags(struct vhost_virtqueue *vq, @@ -2523,9 +2539,8 @@ int vhost_get_vq_desc(struct vhost_virtqueue *vq, struct vhost_log *log, unsigned int *log_num) { struct vring_desc desc; - unsigned int i, head, found = 0; - __virtio16 ring_head; - int ret, access; + unsigned int i, found = 0; + int head, ret, access; if (vq->avail_idx == vq->last_avail_idx) { ret = vhost_get_avail_idx(vq); @@ -2536,23 +2551,10 @@ int vhost_get_vq_desc(struct vhost_virtqueue *vq, return vq->num; } - /* Grab the next descriptor number they're advertising, and increment - * the index we've seen. */ - if (unlikely(vhost_get_avail_head(vq, &ring_head, vq->last_avail_idx))) { - vq_err(vq, "Failed to read head: idx %d address %p\n", - vq->last_avail_idx, - &vq->avail->ring[vq->last_avail_idx % vq->num]); - return -EFAULT; - } - - head = vhost16_to_cpu(vq, ring_head); - - /* If their number is silly, that's an error. */ - if (unlikely(head >= vq->num)) { - vq_err(vq, "Guest says index %u > %u is available", - head, vq->num); - return -EINVAL; - } + /* Grab the next descriptor number they're advertising */ + head = vhost_get_avail_head(vq); + if (unlikely(head < 0)) + return head; /* When we start there are none of either input nor output. */ *out_num = *in_num = 0; -- 2.44.0