tools/lguest: handle indirect partway through chain.

Linux doesn't generate these, but it's perfectly valid according to
a close reading of the spec.  I opened virtio spec bug VIRTIO-134 to
make this clearer there, too.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

diff --git a/tools/lguest/lguest.c b/tools/lguest/lguest.c
index 80dc6346030e9a907b5ca77ccf4aa5e7df7c7a54..990671e61f87ad5e6d9dd60d6cb995a729d8e420 100644 (file)
--- a/tools/lguest/lguest.c
+++ b/tools/lguest/lguest.c
@@ -769,20 +769,21 @@ static unsigned wait_for_vq_desc(struct virtqueue *vq,
         * that: no rmb() required.
         */
 
-       /*
-        * If this is an indirect entry, then this buffer contains a descriptor
-        * table which we handle as if it's any normal descriptor chain.
-        */
-       if (desc[i].flags & VRING_DESC_F_INDIRECT) {
-               if (desc[i].len % sizeof(struct vring_desc))
-                       errx(1, "Invalid size for indirect buffer table");
+       do {
+               /*
+                * If this is an indirect entry, then this buffer contains a
+                * descriptor table which we handle as if it's any normal
+                * descriptor chain.
+                */
+               if (desc[i].flags & VRING_DESC_F_INDIRECT) {
+                       if (desc[i].len % sizeof(struct vring_desc))
+                               errx(1, "Invalid size for indirect buffer table");
 
-               max = desc[i].len / sizeof(struct vring_desc);
-               desc = check_pointer(desc[i].addr, desc[i].len);
-               i = 0;
-       }
+                       max = desc[i].len / sizeof(struct vring_desc);
+                       desc = check_pointer(desc[i].addr, desc[i].len);
+                       i = 0;
+               }
 
-       do {
                /* Grab the first descriptor, and check it's OK. */
                iov[*out_num + *in_num].iov_len = desc[i].len;
                iov[*out_num + *in_num].iov_base