From nobody Sat Oct 24 00:32:22 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=linux.microsoft.com ARC-Seal: i=1; a=rsa-sha256; t=1790894759; cv=none; d=zohomail.com; s=zohoarc; b=PxGArZsz/T1Eqr2I9slo5VkrgFSJw8Aay+WmnfKdF+Vs2PavtHQg3Hy/biHDNDX8E22mSg6re8JT8EeI1tr6NzopC3hOuyL5zOARNdt2cnd0PaQr8mNvvhIs6+uIPO/NwIysAfKpyGZbi/Z6SqGNJtXHlzppd3gdANW7Kd2839M= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790894759; h=Content-Transfer-Encoding:Date:Date:From:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To:Cc; bh=1sEBvs+8ytpbnqpgoFl5oJCCuQJLNx/n/OoSkhHmTJI=; b=IfTCcPV0CtzkAPD56e2Mot2DzqYdUdErNsfRu13hKT9xLepDKDieJnbcg6CK/Y6PJjCusuAXX6VXPi6elncn12X0kOUvjlXfnq7grXnLPtF/ESJn8r5uSwrDySLCpxPqFyIgGWxFeNYL0TgdIyQgnCnyM/b9zlDYwgOoUrSNKEo= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1790894759103378.6885403937591; Thu, 1 Oct 2026 15:45:59 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xCPWY-0001pW-W3; Thu, 01 Oct 2026 18:45:11 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCPWX-0001lh-3S for qemu-devel@nongnu.org; Thu, 01 Oct 2026 18:45:09 -0400 Received: from linux.microsoft.com ([13.77.154.182]) by eggs.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xCPWV-00060R-3U for qemu-devel@nongnu.org; Thu, 01 Oct 2026 18:45:08 -0400 Received: from frill.fritz.box (p508abfc2.dip0.t-ipconnect.de [80.138.191.194]) by linux.microsoft.com (Postfix) with ESMTPSA id CCD6C20B7167 for ; Thu, 1 Oct 2026 15:44:11 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com CCD6C20B7167 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com; s=default; t=1790894652; bh=1sEBvs+8ytpbnqpgoFl5oJCCuQJLNx/n/OoSkhHmTJI=; h=From:To:Subject:Date:From; b=e6zDQ4g0Ja6lycKplUkWq/++QoCjQW1H5pGYFYZtNZnAYSh3mpTYxS0q7rBmeoarU Ej8N71FY3/lSwWhxFhnAMf6AKZZM7lV3oQbxIJSP08u/DRxIJqdnZis4AcVmzfoiYE CSVYKFGcWqtcK+A2GPzIe/olJ/PmBSidBp/La2UA= From: Anatol Belski To: qemu-devel@nongnu.org Subject: [PATCH] hw/audio/virtio-sound: Report bytes written in used length Date: Fri, 2 Oct 2026 00:30:27 +0200 Message-ID: <20261001224501.1952113-1-anbelski@linux.microsoft.com> X-Mailer: git-send-email 2.55.0 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=13.77.154.182; envelope-from=anbelski@linux.microsoft.com; helo=linux.microsoft.com X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @linux.microsoft.com) X-ZM-MESSAGEID: 1790894760416158500 Content-Type: text/plain; charset="utf-8" The control, invalid PCM, TX and RX completion paths pass fixed response sizes to virtqueue_push() after copying into the guest's writable iovecs. iov_from_buf() truncates the copy when those iovecs are undersized, so the used length can exceed the writable descriptor capacity. Use the byte count returned by iov_from_buf() for every completion. For PCM_INFO, retain the actual payload byte count so the control completion also remains bounded when the requested element size is smaller than the native structure. Signed-off-by: Anatol Belski --- Tested with the following virtio-villain reproducers: SND0005: https://github.com/weltling/virtio-villain/blob/e0c649562cf2e836a0a305e19fb= 72323e6543d10/tests/sound/snd0005_info_size_short.c SND0012: https://github.com/weltling/virtio-villain/blob/e0c649562cf2e836a0a305e19fb= 72323e6543d10/tests/sound/snd0012_pcm_info_size_zero.c SND0015: https://github.com/weltling/virtio-villain/blob/e0c649562cf2e836a0a305e19fb= 72323e6543d10/tests/sound/snd0015_pcm_info_status_short.c SND0065: https://github.com/weltling/virtio-villain/blob/e0c649562cf2e836a0a305e19fb= 72323e6543d10/tests/sound/snd0065_tx_missing_status.c SND0066: https://github.com/weltling/virtio-villain/blob/e0c649562cf2e836a0a305e19fb= 72323e6543d10/tests/sound/snd0066_tx_status_short.c Before this change all five tests fail because the used length exceeds the writable descriptor capacity. With this change all five pass. hw/audio/virtio-snd.c | 82 +++++++++++++++++++++---------------------- 1 file changed, 40 insertions(+), 42 deletions(-) diff --git a/hw/audio/virtio-snd.c b/hw/audio/virtio-snd.c index 6df7ea0eb0..52e12603dd 100644 --- a/hw/audio/virtio-snd.c +++ b/hw/audio/virtio-snd.c @@ -271,13 +271,12 @@ static void virtio_snd_handle_pcm_info(VirtIOSound *s, memset(&pcm_info[i].padding, 0, 5); } =20 - cmd->payload_size =3D sizeof(virtio_snd_pcm_info) * count; cmd->resp.code =3D cpu_to_le32(VIRTIO_SND_S_OK); - iov_from_buf(cmd->elem->in_sg, - cmd->elem->in_num, - sizeof(virtio_snd_hdr), - pcm_info, - cmd->payload_size); + cmd->payload_size =3D iov_from_buf(cmd->elem->in_sg, + cmd->elem->in_num, + sizeof(virtio_snd_hdr), + pcm_info, + sizeof(virtio_snd_pcm_info) * count); } =20 /* @@ -774,6 +773,7 @@ static inline void process_cmd(VirtIOSound *s, virtio_snd_ctrl_command *cmd) { uint32_t code; + size_t written; size_t msg_sz =3D iov_to_buf(cmd->elem->out_sg, cmd->elem->out_num, 0, @@ -828,13 +828,12 @@ process_cmd(VirtIOSound *s, virtio_snd_ctrl_command *= cmd) cmd->resp.code =3D cpu_to_le32(VIRTIO_SND_S_BAD_MSG); } =20 - iov_from_buf(cmd->elem->in_sg, - cmd->elem->in_num, - 0, - &cmd->resp, - sizeof(virtio_snd_hdr)); - virtqueue_push(cmd->vq, cmd->elem, - sizeof(virtio_snd_hdr) + cmd->payload_size); + written =3D iov_from_buf(cmd->elem->in_sg, + cmd->elem->in_num, + 0, + &cmd->resp, + sizeof(virtio_snd_hdr)); + virtqueue_push(cmd->vq, cmd->elem, written + cmd->payload_size); g_assert(s->queue_inuse[VIRTIO_SND_VQ_CONTROL] > 0); s->queue_inuse[VIRTIO_SND_VQ_CONTROL] -=3D 1; virtio_notify(VIRTIO_DEVICE(s), cmd->vq); @@ -917,6 +916,7 @@ static inline void empty_invalid_queue(VirtIODevice *vd= ev, VirtQueue *vq) VirtIOSoundPCMBuffer *buffer =3D NULL; virtio_snd_pcm_status resp =3D { 0 }; VirtIOSound *vsnd =3D VIRTIO_SND(vdev); + size_t written; =20 g_assert(!QSIMPLEQ_EMPTY(&vsnd->invalid)); =20 @@ -926,14 +926,12 @@ static inline void empty_invalid_queue(VirtIODevice *= vdev, VirtQueue *vq) g_assert(buffer->vq =3D=3D vq); =20 resp.status =3D cpu_to_le32(VIRTIO_SND_S_BAD_MSG); - iov_from_buf(buffer->elem->in_sg, - buffer->elem->in_num, - 0, - &resp, - sizeof(virtio_snd_pcm_status)); - virtqueue_push(vq, - buffer->elem, - sizeof(virtio_snd_pcm_status)); + written =3D iov_from_buf(buffer->elem->in_sg, + buffer->elem->in_num, + 0, + &resp, + sizeof(virtio_snd_pcm_status)); + virtqueue_push(vq, buffer->elem, written); QSIMPLEQ_REMOVE_HEAD(&vsnd->invalid, entry); virtio_snd_pcm_buffer_free(buffer); } @@ -1216,17 +1214,17 @@ static inline void return_tx_buffer(VirtIOSoundPCMS= tream *stream, VirtIOSoundPCMBuffer *buffer) { virtio_snd_pcm_status resp =3D { 0 }; + size_t written; + resp.status =3D cpu_to_le32(VIRTIO_SND_S_OK); update_latency(stream, buffer->size); resp.latency_bytes =3D cpu_to_le32(stream->latency_bytes); - iov_from_buf(buffer->elem->in_sg, - buffer->elem->in_num, - 0, - &resp, - sizeof(virtio_snd_pcm_status)); - virtqueue_push(buffer->vq, - buffer->elem, - sizeof(virtio_snd_pcm_status)); + written =3D iov_from_buf(buffer->elem->in_sg, + buffer->elem->in_num, + 0, + &resp, + sizeof(virtio_snd_pcm_status)); + virtqueue_push(buffer->vq, buffer->elem, written); g_assert(stream->s->queue_inuse[VIRTIO_SND_VQ_TX] > 0); stream->s->queue_inuse[VIRTIO_SND_VQ_TX] -=3D 1; virtio_notify(VIRTIO_DEVICE(stream->s), buffer->vq); @@ -1306,22 +1304,22 @@ static inline void return_rx_buffer(VirtIOSoundPCMS= tream *stream, VirtIOSoundPCMBuffer *buffer) { virtio_snd_pcm_status resp =3D { 0 }; + size_t written; + resp.status =3D cpu_to_le32(VIRTIO_SND_S_OK); resp.latency_bytes =3D 0; /* Copy data -if any- to guest */ - iov_from_buf(buffer->elem->in_sg, - buffer->elem->in_num, - 0, - buffer->data, - buffer->size); - iov_from_buf(buffer->elem->in_sg, - buffer->elem->in_num, - buffer->size, - &resp, - sizeof(virtio_snd_pcm_status)); - virtqueue_push(buffer->vq, - buffer->elem, - sizeof(virtio_snd_pcm_status) + buffer->size); + written =3D iov_from_buf(buffer->elem->in_sg, + buffer->elem->in_num, + 0, + buffer->data, + buffer->size); + written +=3D iov_from_buf(buffer->elem->in_sg, + buffer->elem->in_num, + buffer->size, + &resp, + sizeof(virtio_snd_pcm_status)); + virtqueue_push(buffer->vq, buffer->elem, written); g_assert(stream->s->queue_inuse[VIRTIO_SND_VQ_RX] > 0); stream->s->queue_inuse[VIRTIO_SND_VQ_RX] -=3D 1; virtio_notify(VIRTIO_DEVICE(stream->s), buffer->vq); --=20 2.55.0