mirror of
https://github.com/cloud-hypervisor/cloud-hypervisor.git
synced 2026-08-05 02:19:16 +00:00
Several error paths in process_desc_chain returned the error before calling queue.add_used for the offending descriptor. The affected variants were DescriptorChainInvalid, DescriptorChainTooShort, DescriptorInvalidHeader, and the GuestMemory variants raised during descriptor chain translation, slice retrieval, or the num_buffers write on the RX side. Without an entry in the used ring the head descriptor remained owned by the device. A guest that kept submitting bad chains could deplete the queue over time. Mark the head descriptor used with length 0 before propagating the error to the caller, so the ring stays consistent regardless of how the device decides to react to a guest induced failure. Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>