43 lines
1.4 KiB
Diff
43 lines
1.4 KiB
Diff
From 74ab61b4317f12b231fb2cbcd54a333a07efd678 Mon Sep 17 00:00:00 2001
|
|
From: Jinhua Cao <caojinhua1@huawei.com>
|
|
Date: Thu, 10 Feb 2022 14:37:52 +0800
|
|
Subject: [PATCH] virtio: bugfix: check the value of caches before accessing it
|
|
|
|
Vring caches may be NULL in check_vring_avail_num() if
|
|
virtio_reset() is called at the same time, such as when
|
|
the virtual machine starts.
|
|
So check it before accessing it in vring_avail_idx().
|
|
|
|
Signed-off-by: Jinhua Cao <caojinhua1@huawei.com>
|
|
---
|
|
hw/virtio/virtio.c | 11 +++++++++++
|
|
1 file changed, 11 insertions(+)
|
|
|
|
diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
|
|
index 9a2a83d507..b08fff9419 100644
|
|
--- a/hw/virtio/virtio.c
|
|
+++ b/hw/virtio/virtio.c
|
|
@@ -2863,8 +2863,19 @@ static const VMStateDescription vmstate_virtio = {
|
|
static void check_vring_avail_num(VirtIODevice *vdev, int index)
|
|
{
|
|
uint16_t nheads;
|
|
+ VRingMemoryRegionCaches *caches;
|
|
|
|
rcu_read_lock();
|
|
+ caches = qatomic_rcu_read(&vdev->vq[index].vring.caches);
|
|
+ if (caches == NULL) {
|
|
+ /*
|
|
+ * caches may be NULL if virtio_reset is called at the same time,
|
|
+ * such as when the virtual machine starts.
|
|
+ */
|
|
+ rcu_read_unlock();
|
|
+ return;
|
|
+ }
|
|
+
|
|
/* Check it isn't doing strange things with descriptor numbers. */
|
|
nheads = vring_avail_idx(&vdev->vq[index]) - vdev->vq[index].last_avail_idx;
|
|
if (nheads > vdev->vq[index].vring.num) {
|
|
--
|
|
2.27.0
|
|
|