External/passt
1
0
Fork 0
mirror of https://passt.top/passt synced 2024-12-21 21:25:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

virtio: check if avail ring is configured

Browse Source 
If the connection to the vhost-user front end is closed during transfers
virtio rings are deconfigured and not available anymore, but we can
try to access them to process queued data. This can trigger a SIGSEG as
we try to access unavailable memory.
To fix that check vq->vring.avail is sane before accessing the vring

Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
This commit is contained in:
Laurent Vivier 2024-11-27 11:25:21 +01:00 committed by Stefano Brivio
parent 7e131e920c
commit 6fae899cbb
1 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
virtio.c
View File

@ -284,6 +284,9 @@ static int virtqueue_read_next_desc(const struct vring_desc *desc,
*/
bool vu_queue_empty(struct vu_virtq *vq)
{
if (!vq->vring.avail)
return true;
if (vq->shadow_avail_idx != vq->last_avail_idx)
return false;
@ -327,6 +330,9 @@ static bool vring_can_notify(const struct vu_dev *dev, struct vu_virtq *vq)
*/
void vu_queue_notify(const struct vu_dev *dev, struct vu_virtq *vq)
{
if (!vq->vring.avail)
return;
if (!vring_can_notify(dev, vq)) {
debug("vhost-user: virtqueue can skip notify...");
return;
@ -502,6 +508,9 @@ int vu_queue_pop(struct vu_dev *dev, struct vu_virtq *vq, struct vu_virtq_elemen
unsigned int head;
int ret;
if (!vq->vring.avail)
return -1;
if (vu_queue_empty(vq))
return -1;
@ -591,6 +600,9 @@ void vu_queue_fill_by_index(struct vu_virtq *vq, unsigned int index,
{
struct vring_used_elem uelem;
if (!vq->vring.avail)
return;
idx = (idx + vq->used_idx) % vq->vring.num;
uelem.id = htole32(index);
@ -633,6 +645,9 @@ void vu_queue_flush(struct vu_virtq *vq, unsigned int count)
{
uint16_t old, new;
if (!vq->vring.avail)
return;
/* Make sure buffer is written before we update index. */
smp_wmb();