39a0a891d8
- vdpa: move memory listener to the realize stage - vdpa: implement vdpa device migration - vhost: implement post resume bh - vhost: implement migration state notifier for vdpa device - vhost: implement savevm_hanlder for vdpa device - vhost: implement vhost_vdpa_device_suspend/resume - vhost: implement vhost-vdpa suspend/resume - vhost: add vhost_dev_suspend/resume_op - vhost: introduce bytemap for vhost backend logging - vhost-vdpa: add migration log ops for VhostOps - vhost-vdpa: add VHOST_BACKEND_F_BYTEMAPLOG - vhost: fix null pointer access - ui/gtk: prevent ui lock up when dpy_gl_update called again before current draw event occurs - hw/usb: dev-mtp: Use g_mkdir() - target/ppc/cpu-models: Remove the "default" CPU alias - hw/intc/arm_gicv3: ICC_PMR_EL1 high bits should be RAZ - Fixed a QEMU hang when guest poweroff in COLO mode - migration/colo: More accurate update checkpoint time - scripts/entitlement.sh: Use backward-compatible cp flags - block/nvme: fix infinite loop in nvme_free_req_queue_cb() - hw/net: npcm7xx_emc fix missing queue_flush - Add dummy Aspeed AST2600 Display Port MCU (DPMCU) - hw/arm: ast2600: Fix address mapping of second SPI controller - vhost-user-blk: reconnect on any error during realize - vhost-user-blk: propagate error return from generic vhost - hw/riscv: boot: Reduce FDT address alignment constraints - Revert "hw/virtio/virtio-iommu-pci: Enforce the device is plugged on the root bus" - Fix STM32F2XX USART data register readout - block: use 'unsigned' for in_flight field on driver state - sphinx: change default language to 'en' - tests/qtest: Fix two format strings - trivial typos: namesapce - hw/ide/atapi.c: Correct typos (CD-CDROM -> CD-ROM) - hw/virtio/virtio-iommu-pci: Enforce the device is plugged on the root bus - hw/display/next-fb: Fix comment typo - xen/pass-through: merge emulated bits correctly mainline inclusion commit be9c61da9fc57eb7d293f380d0805ca6f46c2657 category: bugfix - tests/qtest/migration-test.c: spelling fix: bandwith - target/i386/cpu: Improve error message for property "vendor" - balloon: Fix a misleading error message - target/arm: Don't set syndrome ISS for loads and stores with writeback mainline inclusion commit 53ae2fdef1f5661cbaa2ea571c517f98e6041cb8 category: bugfix - disas/hppa: Show hexcode of instruction along with disassembly - tcg/loongarch64: Fix tcg_out_mov() Aborted - ui/qmp-cmds: Improve two error messages - qga: Improve guest-exec-status error message - hmp: Improve sync-profile error message - spapr/pci: Correct "does not support hotplugging error messages - xen/pass-through: don't create needless register group mainline inclusion commit c0e86b7624cb9d6db03e0d48cf82659e5b89a6a6 category: bugfix Signed-off-by: Jiabo Feng <fengjiabo1@huawei.com>
75 lines
2.5 KiB
Diff
75 lines
2.5 KiB
Diff
From e2db610c0b0cb9130ba1ce2668a57318a416fdc4 Mon Sep 17 00:00:00 2001
|
|
From: fangyi <eric.fangyi@huawei.com>
|
|
Date: Mon, 4 Dec 2023 14:48:18 +0800
|
|
Subject: [PATCH] vhost: fix null pointer access
|
|
|
|
Check vhost_get/set_used_memslots function before calling it.
|
|
|
|
Signed-off-by: libai <libai12@huawei.com>
|
|
Signed-off-by: jiangdongxu <jiangdongxu1@huawei.com>
|
|
Signed-off-by: fangyi <eric.fangyi@huawei.com>
|
|
---
|
|
hw/virtio/vhost.c | 18 ++++++++++++++++--
|
|
1 file changed, 16 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
|
|
index 59a12735f9..7930b37499 100644
|
|
--- a/hw/virtio/vhost.c
|
|
+++ b/hw/virtio/vhost.c
|
|
@@ -58,6 +58,10 @@ bool vhost_has_free_slot(void)
|
|
struct vhost_dev *hdev;
|
|
|
|
QLIST_FOREACH(hdev, &vhost_devices, entry) {
|
|
+ if (!hdev->vhost_ops->vhost_get_used_memslots ||
|
|
+ !hdev->vhost_ops->vhost_backend_memslots_limit) {
|
|
+ continue;
|
|
+ }
|
|
if (hdev->vhost_ops->vhost_get_used_memslots() >=
|
|
hdev->vhost_ops->vhost_backend_memslots_limit(hdev)) {
|
|
return false;
|
|
@@ -748,7 +752,9 @@ static void vhost_region_add_section(struct vhost_dev *dev,
|
|
dev->tmp_sections[dev->n_tmp_sections - 1].fv = NULL;
|
|
memory_region_ref(section->mr);
|
|
}
|
|
- dev->vhost_ops->vhost_set_used_memslots(dev);
|
|
+ if (dev->vhost_ops->vhost_set_used_memslots) {
|
|
+ dev->vhost_ops->vhost_set_used_memslots(dev);
|
|
+ }
|
|
}
|
|
|
|
/* Used for both add and nop callbacks */
|
|
@@ -772,7 +778,9 @@ static void vhost_region_del(MemoryListener *listener,
|
|
if (!vhost_section(dev, section)) {
|
|
return;
|
|
}
|
|
- dev->vhost_ops->vhost_set_used_memslots(dev);
|
|
+ if (dev->vhost_ops->vhost_set_used_memslots) {
|
|
+ dev->vhost_ops->vhost_set_used_memslots(dev);
|
|
+ }
|
|
}
|
|
|
|
static void vhost_iommu_unmap_notify(IOMMUNotifier *n, IOMMUTLBEntry *iotlb)
|
|
@@ -1367,6 +1375,11 @@ static void vhost_virtqueue_cleanup(struct vhost_virtqueue *vq)
|
|
|
|
static bool vhost_dev_used_memslots_is_exceeded(struct vhost_dev *hdev)
|
|
{
|
|
+ if (!hdev->vhost_ops->vhost_get_used_memslots ||
|
|
+ !hdev->vhost_ops->vhost_backend_memslots_limit) {
|
|
+ goto out;
|
|
+ }
|
|
+
|
|
if (hdev->vhost_ops->vhost_get_used_memslots() >
|
|
hdev->vhost_ops->vhost_backend_memslots_limit(hdev)) {
|
|
error_report("vhost backend memory slots limit is less"
|
|
@@ -1375,6 +1388,7 @@ static bool vhost_dev_used_memslots_is_exceeded(struct vhost_dev *hdev)
|
|
return true;
|
|
}
|
|
|
|
+out:
|
|
used_memslots_exceeded = false;
|
|
return false;
|
|
}
|
|
--
|
|
2.27.0
|
|
|