39 lines
1.2 KiB
Diff
39 lines
1.2 KiB
Diff
|
From 7b4a9547e68147291e68258db9415ef5a20fe06b Mon Sep 17 00:00:00 2001
|
||
|
|
From: Jinhua Cao <caojinhua1@huawei.com>
|
||
|
|
Date: Thu, 10 Feb 2022 11:16:26 +0800
|
||
|
|
Subject: [PATCH] virtio: bugfix: add rcu_read_lock when vring_avail_idx is
|
||
|
|
called
|
||
|
|
|
||
|
|
viring_avail_idx should be called within rcu_read_lock(),
|
||
|
|
or may get NULL caches in vring_get_region_caches() and
|
||
|
|
trigger assert().
|
||
|
|
|
||
|
|
Signed-off-by: Jinhua Cao <caojinhua1@huawei.com>
|
||
|
|
---
|
||
|
|
hw/virtio/virtio.c | 2 ++
|
||
|
|
1 file changed, 2 insertions(+)
|
||
|
|
|
||
|
|
diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
|
||
|
|
index 27ceab92be..ec09d515c2 100644
|
||
|
|
--- a/hw/virtio/virtio.c
|
||
|
|
+++ b/hw/virtio/virtio.c
|
||
|
|
@@ -2801,6 +2801,7 @@ static void check_vring_avail_num(VirtIODevice *vdev, int index)
|
||
|
|
{
|
||
|
|
uint16_t nheads;
|
||
|
|
|
||
|
|
+ rcu_read_lock();
|
||
|
|
/* Check it isn't doing strange things with descriptor numbers. */
|
||
|
|
nheads = vring_avail_idx(&vdev->vq[index]) - vdev->vq[index].last_avail_idx;
|
||
|
|
if (nheads > vdev->vq[index].vring.num) {
|
||
|
|
@@ -2811,6 +2812,7 @@ static void check_vring_avail_num(VirtIODevice *vdev, int index)
|
||
|
|
vring_avail_idx(&vdev->vq[index]),
|
||
|
|
vdev->vq[index].last_avail_idx, nheads);
|
||
|
|
}
|
||
|
|
+ rcu_read_unlock();
|
||
|
|
}
|
||
|
|
|
||
|
|
int virtio_save(VirtIODevice *vdev, QEMUFile *f)
|
||
|
|
--
|
||
|
|
2.27.0
|
||
|
|
|