packages/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

virtio: bugfix: check the value of caches before accessing it

Browse Source 
Vring caches may be NULL in check_vring_avail_num() if
virtio_reset() is called at the same time, such as when
the virtual machine starts.
So check it before accessing it in vring_avail_idx().

Signed-off-by: Jinhua Cao <caojinhua1@huawei.com>
This commit is contained in:
Chen Qun 2022-02-10 14:37:52 +08:00 committed by yezengruan
parent ca01e036b8
commit c0e69b781c
1 changed files with 42 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
virtio-bugfix-check-the-value-of-caches-before-acces.patch Normal file
View File

@ -0,0 +1,42 @@
From 74ab61b4317f12b231fb2cbcd54a333a07efd678 Mon Sep 17 00:00:00 2001
From: Jinhua Cao <caojinhua1@huawei.com>
Date: Thu, 10 Feb 2022 14:37:52 +0800
Subject: [PATCH] virtio: bugfix: check the value of caches before accessing it
Vring caches may be NULL in check_vring_avail_num() if
virtio_reset() is called at the same time, such as when
the virtual machine starts.
So check it before accessing it in vring_avail_idx().
Signed-off-by: Jinhua Cao <caojinhua1@huawei.com>
---
hw/virtio/virtio.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index 9a2a83d507..b08fff9419 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -2863,8 +2863,19 @@ static const VMStateDescription vmstate_virtio = {
static void check_vring_avail_num(VirtIODevice *vdev, int index)
{
uint16_t nheads;
+ VRingMemoryRegionCaches *caches;
rcu_read_lock();
+ caches = qatomic_rcu_read(&vdev->vq[index].vring.caches);
+ if (caches == NULL) {
+ /*
+ * caches may be NULL if virtio_reset is called at the same time,
+ * such as when the virtual machine starts.
+ */
+ rcu_read_unlock();
+ return;
+ }
+
/* Check it isn't doing strange things with descriptor numbers. */
nheads = vring_avail_idx(&vdev->vq[index]) - vdev->vq[index].last_avail_idx;
if (nheads > vdev->vq[index].vring.num) {
--
2.27.0