From b57e956ea522b487081d1c94aa2e4af6a3314d20 Mon Sep 17 00:00:00 2001
From: Jinhua Cao <caojinhua1@huawei.com>
Date: Thu, 10 Feb 2022 11:09:36 +0800
Subject: [PATCH] virtio: check descriptor numbers

Check if the vring num is normal in virtio_save(), and add LOG
the vm push the wrong viring num down through writing IO Port.

Signed-off-by: Jinhua Cao <caojinhua1@huawei.com>
---
 hw/virtio/virtio.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index a9aa0c4f66..27ceab92be 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -2797,6 +2797,22 @@ static const VMStateDescription vmstate_virtio = {
     }
 };
 
+static void check_vring_avail_num(VirtIODevice *vdev, int index)
+{
+    uint16_t nheads;
+
+    /* Check it isn't doing strange things with descriptor numbers. */
+    nheads = vring_avail_idx(&vdev->vq[index]) - vdev->vq[index].last_avail_idx;
+    if (nheads > vdev->vq[index].vring.num) {
+        qemu_log("VQ %d size 0x%x Guest index 0x%x "
+                 "inconsistent with Host index 0x%x: "
+                 "delta 0x%x\n",
+                 index, vdev->vq[index].vring.num,
+                 vring_avail_idx(&vdev->vq[index]),
+                 vdev->vq[index].last_avail_idx, nheads);
+    }
+}
+
 int virtio_save(VirtIODevice *vdev, QEMUFile *f)
 {
     BusState *qbus = qdev_get_parent_bus(DEVICE(vdev));
@@ -2827,6 +2843,8 @@ int virtio_save(VirtIODevice *vdev, QEMUFile *f)
         if (vdev->vq[i].vring.num == 0)
             break;
 
+        check_vring_avail_num(vdev, i);
+
         qemu_put_be32(f, vdev->vq[i].vring.num);
         if (k->has_variable_vring_alignment) {
             qemu_put_be32(f, vdev->vq[i].vring.align);
-- 
2.27.0