[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH 1/2] libvhost-user: fix vu_queue_get_avail_bytes
From: |
Marc-André Lureau |
Subject: |
Re: [Qemu-devel] [PATCH 1/2] libvhost-user: fix vu_queue_get_avail_bytes() crash |
Date: |
Wed, 3 May 2017 08:32:48 -0400 (EDT) |
Hi
----- Original Message -----
> Hi Marc-André,
>
> On 05/03/2017 09:11 AM, Marc-André Lureau wrote:
> > Calling vu_queue_get_avail_bytes() when the queue doesn't yet have
> > addresses will result in the following crash:
> >
> > Program received signal SIGSEGV, Segmentation fault.
> > 0x000055c414112ce4 in vring_avail_idx (vq=0x55c41582fd68,
> > vq=0x55c41582fd68)
> > at /home/dgilbert/git/qemu/contrib/libvhost-user/libvhost-user.c:940
> > 940 vq->shadow_avail_idx = vq->vring.avail->idx;
> > (gdb) p vq
> > $1 = (VuVirtq *) 0x55c41582fd68
> > (gdb) p vq->vring
> > $2 = {num = 0, desc = 0x0, avail = 0x0, used = 0x0, log_guest_addr = 0,
> > flags = 0}
> >
> > at /home/dgilbert/git/qemu/contrib/libvhost-user/libvhost-user.c:940
> > No locals.
> > at /home/dgilbert/git/qemu/contrib/libvhost-user/libvhost-user.c:960
> > num_heads = <optimized out>
> > address@hidden,
> > address@hidden,
> > address@hidden) at
> > /home/dgilbert/git/qemu/contrib/libvhost-user/libvhost-user.c:1034
> >
> > Check if vring.avail != null before accessing it.
> >
> > Signed-off-by: Marc-André Lureau <address@hidden>
> > ---
> > contrib/libvhost-user/libvhost-user.c | 4 ++++
> > 1 file changed, 4 insertions(+)
> >
> > diff --git a/contrib/libvhost-user/libvhost-user.c
> > b/contrib/libvhost-user/libvhost-user.c
> > index af4faad60b..f9680b6279 100644
> > --- a/contrib/libvhost-user/libvhost-user.c
> > +++ b/contrib/libvhost-user/libvhost-user.c
> > @@ -1031,6 +1031,10 @@ vu_queue_get_avail_bytes(VuDev *dev, VuVirtq *vq,
> > unsigned int *in_bytes,
> > idx = vq->last_avail_idx;
> >
> > total_bufs = in_total = out_total = 0;
> > + if (!vq->vring.avail) {
> > + goto done;
> > + }
> > +
> > while ((rc = virtqueue_num_heads(dev, vq, idx)) > 0) {
> > unsigned int max, num_bufs, indirect = 0;
> > struct vring_desc *desc;
> >
>
> It seems to me safer to fix instead vring_avail_ring(), and fix
> neighbours vring_avail_flags() and vring_avail_idx() while here.
Those are internal/static functions, possibly on hot paths. So I would rather
keep the check on the external/public functions only.