| Message ID | 20170630160422.14842-2-maxime.coquelin@redhat.com |
|---|---|
| State | New |
| Headers | show |
----- Original Message ----- > This patch fixes a crash that happens when vhost-user iommu > support is enabled and vhost-user socket is closed. > > When it happens, if an IOTLB invalidation notification is sent > by the IOMMU, vhost_ops's NULL pointer is dereferenced. > > Signed-off-by: Maxime Coquelin <maxime.coquelin@redhat.com> looks fine to me, Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> > --- > hw/virtio/vhost-backend.c | 10 ++++++++-- > 1 file changed, 8 insertions(+), 2 deletions(-) > > diff --git a/hw/virtio/vhost-backend.c b/hw/virtio/vhost-backend.c > index 4e31de1..cb055e8 100644 > --- a/hw/virtio/vhost-backend.c > +++ b/hw/virtio/vhost-backend.c > @@ -309,7 +309,10 @@ int vhost_backend_update_device_iotlb(struct vhost_dev > *dev, > return -EINVAL; > } > > - return dev->vhost_ops->vhost_send_device_iotlb_msg(dev, &imsg); > + if (dev->vhost_ops && dev->vhost_ops->vhost_send_device_iotlb_msg) > + return dev->vhost_ops->vhost_send_device_iotlb_msg(dev, &imsg); > + > + return -ENODEV; > } > > int vhost_backend_invalidate_device_iotlb(struct vhost_dev *dev, > @@ -321,7 +324,10 @@ int vhost_backend_invalidate_device_iotlb(struct > vhost_dev *dev, > imsg.size = len; > imsg.type = VHOST_IOTLB_INVALIDATE; > > - return dev->vhost_ops->vhost_send_device_iotlb_msg(dev, &imsg); > + if (dev->vhost_ops && dev->vhost_ops->vhost_send_device_iotlb_msg) > + return dev->vhost_ops->vhost_send_device_iotlb_msg(dev, &imsg); > + > + return -ENODEV; > } > > int vhost_backend_handle_iotlb_msg(struct vhost_dev *dev, > -- > 2.9.4 > >
diff --git a/hw/virtio/vhost-backend.c b/hw/virtio/vhost-backend.c index 4e31de1..cb055e8 100644 --- a/hw/virtio/vhost-backend.c +++ b/hw/virtio/vhost-backend.c @@ -309,7 +309,10 @@ int vhost_backend_update_device_iotlb(struct vhost_dev *dev, return -EINVAL; } - return dev->vhost_ops->vhost_send_device_iotlb_msg(dev, &imsg); + if (dev->vhost_ops && dev->vhost_ops->vhost_send_device_iotlb_msg) + return dev->vhost_ops->vhost_send_device_iotlb_msg(dev, &imsg); + + return -ENODEV; } int vhost_backend_invalidate_device_iotlb(struct vhost_dev *dev, @@ -321,7 +324,10 @@ int vhost_backend_invalidate_device_iotlb(struct vhost_dev *dev, imsg.size = len; imsg.type = VHOST_IOTLB_INVALIDATE; - return dev->vhost_ops->vhost_send_device_iotlb_msg(dev, &imsg); + if (dev->vhost_ops && dev->vhost_ops->vhost_send_device_iotlb_msg) + return dev->vhost_ops->vhost_send_device_iotlb_msg(dev, &imsg); + + return -ENODEV; } int vhost_backend_handle_iotlb_msg(struct vhost_dev *dev,
This patch fixes a crash that happens when vhost-user iommu support is enabled and vhost-user socket is closed. When it happens, if an IOTLB invalidation notification is sent by the IOMMU, vhost_ops's NULL pointer is dereferenced. Signed-off-by: Maxime Coquelin <maxime.coquelin@redhat.com> --- hw/virtio/vhost-backend.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)