If the connection to the vhost-user front end is closed during transfers
virtio rings are deconfigured and not available anymore, but we can
try to access them to process queued data. This can trigger a SIGSEG as
we try to access unavailable memory.
To fix that check vq->vring.avail is sane before accessing the vring
Signed-off-by: Laurent Vivier <lvivier(a)redhat.com>
---
virtio.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/virtio.c b/virtio.c
index 6a97435e2965..0598ff479858 100644
--- a/virtio.c
+++ b/virtio.c
@@ -284,6 +284,9 @@ static int virtqueue_read_next_desc(const struct vring_desc *desc,
*/
bool vu_queue_empty(struct vu_virtq *vq)
{
+ if (!vq->vring.avail)
+ return true;
+
if (vq->shadow_avail_idx != vq->last_avail_idx)
return false;
@@ -327,6 +330,9 @@ static bool vring_can_notify(const struct vu_dev *dev, struct vu_virtq
*vq)
*/
void vu_queue_notify(const struct vu_dev *dev, struct vu_virtq *vq)
{
+ if (!vq->vring.avail)
+ return;
+
if (!vring_can_notify(dev, vq)) {
debug("vhost-user: virtqueue can skip notify...");
return;
@@ -502,6 +508,9 @@ int vu_queue_pop(struct vu_dev *dev, struct vu_virtq *vq, struct
vu_virtq_elemen
unsigned int head;
int ret;
+ if (!vq->vring.avail)
+ return -1;
+
if (vu_queue_empty(vq))
return -1;
@@ -591,6 +600,9 @@ void vu_queue_fill_by_index(struct vu_virtq *vq, unsigned int index,
{
struct vring_used_elem uelem;
+ if (!vq->vring.avail)
+ return;
+
idx = (idx + vq->used_idx) % vq->vring.num;
uelem.id = htole32(index);
@@ -633,6 +645,9 @@ void vu_queue_flush(struct vu_virtq *vq, unsigned int count)
{
uint16_t old, new;
+ if (!vq->vring.avail)
+ return;
+
/* Make sure buffer is written before we update index. */
smp_wmb();
--
2.47.0