diff options
| -rw-r--r-- | hw/virtio/virtio.c | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c index 15ee3a71fa..6105c6eb62 100644 --- a/hw/virtio/virtio.c +++ b/hw/virtio/virtio.c @@ -1648,6 +1648,21 @@ int virtio_load(VirtIODevice *vdev, QEMUFile *f, int version_id) } vdev->vq[i].used_idx = vring_used_idx(&vdev->vq[i]); vdev->vq[i].shadow_avail_idx = vring_avail_idx(&vdev->vq[i]); + + /* + * Some devices migrate VirtQueueElements that have been popped + * from the avail ring but not yet returned to the used ring. + */ + vdev->vq[i].inuse = vdev->vq[i].last_avail_idx - + vdev->vq[i].used_idx; + if (vdev->vq[i].inuse > vdev->vq[i].vring.num) { + error_report("VQ %d size 0x%x < last_avail_idx 0x%x - " + "used_idx 0x%x", + i, vdev->vq[i].vring.num, + vdev->vq[i].last_avail_idx, + vdev->vq[i].used_idx); + return -1; + } } } |