External/passt
1
0
Fork 0
mirror of https://passt.top/passt synced 2024-12-22 13:45:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

virtio: check if avail ring is configured

Browse Source 
If the connection to the vhost-user front end is closed during transfers
virtio rings are deconfigured and not available anymore, but we can
try to access them to process queued data. This can trigger a SIGSEG as
we try to access unavailable memory.
To fix that check vq->vring.avail is sane before accessing the vring

Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
This commit is contained in:
Laurent Vivier 2024-11-27 11:25:21 +01:00 committed by Stefano Brivio
parent 7e131e920c
commit 6fae899cbb
1 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
virtio.c
View File

@ -284,6 +284,9 @@ static int virtqueue_read_next_desc(const struct vring_desc *desc,
*/ */
bool vu_queue_empty(struct vu_virtq *vq) bool vu_queue_empty(struct vu_virtq *vq)
{ {
if (!vq->vring.avail)
return true;
if (vq->shadow_avail_idx != vq->last_avail_idx) if (vq->shadow_avail_idx != vq->last_avail_idx)
return false; return false;
@ -327,6 +330,9 @@ static bool vring_can_notify(const struct vu_dev *dev, struct vu_virtq *vq)
*/ */
void vu_queue_notify(const struct vu_dev *dev, struct vu_virtq *vq) void vu_queue_notify(const struct vu_dev *dev, struct vu_virtq *vq)
{ {
if (!vq->vring.avail)
return;
if (!vring_can_notify(dev, vq)) { if (!vring_can_notify(dev, vq)) {
debug("vhost-user: virtqueue can skip notify..."); debug("vhost-user: virtqueue can skip notify...");
return; return;
@ -502,6 +508,9 @@ int vu_queue_pop(struct vu_dev *dev, struct vu_virtq *vq, struct vu_virtq_elemen
unsigned int head; unsigned int head;
int ret; int ret;
if (!vq->vring.avail)
return -1;
if (vu_queue_empty(vq)) if (vu_queue_empty(vq))
return -1; return -1;
@ -591,6 +600,9 @@ void vu_queue_fill_by_index(struct vu_virtq *vq, unsigned int index,
{ {
struct vring_used_elem uelem; struct vring_used_elem uelem;
if (!vq->vring.avail)
return;
idx = (idx + vq->used_idx) % vq->vring.num; idx = (idx + vq->used_idx) % vq->vring.num;
uelem.id = htole32(index); uelem.id = htole32(index);
@ -633,6 +645,9 @@ void vu_queue_flush(struct vu_virtq *vq, unsigned int count)
{ {
uint16_t old, new; uint16_t old, new;
if (!vq->vring.avail)
return;
/* Make sure buffer is written before we update index. */ /* Make sure buffer is written before we update index. */
smp_wmb(); smp_wmb();