在 2021/3/31 下午4:05, Xie Yongji 写道:

+	}
+	case VDUSE_INJECT_VQ_IRQ:
+		ret = -EINVAL;
+		if (arg >= dev->vq_num)
+			break;
+
+		ret = 0;
+		queue_work(vduse_irq_wq, &dev->vqs[arg].inject);
+		break;

One additional note:

Please use array_index_nospec() for all vqs[idx] access where idx is 
under the control of userspace to avoid potential spectre exploitation.

Thanks