[PATCH] vhost: fix null pointer dereference
Maxime Coquelin
maxime.coquelin at redhat.com
Wed Jun 1 09:58:17 CEST 2022
HI Jiayu,
On 3/28/22 09:04, David Marchand wrote:
> On Mon, Mar 28, 2022 at 4:08 AM Jiayu Hu <jiayu.hu at intel.com> wrote:
>>
>> NULL check for vq->async must be protected by lock. Otherwise, it is
>> possible that the data plane thread dereferences vq->async with NULL
>> value, since the control plane thread is freeing vq->async.
>>
>> Fixes: ee8024b3d4ad (vhost: move async data in dedicated structure)
>> Cc: stable at dpdk.org
>>
>> Signed-off-by: Jiayu Hu <jiayu.hu at intel.com>
>> ---
>> lib/vhost/vhost.c | 6 +++---
>> 1 file changed, 3 insertions(+), 3 deletions(-)
>>
>> diff --git a/lib/vhost/vhost.c b/lib/vhost/vhost.c
>> index bc88148347..7f60c2824f 100644
>> --- a/lib/vhost/vhost.c
>> +++ b/lib/vhost/vhost.c
>> @@ -1887,9 +1887,6 @@ rte_vhost_async_get_inflight(int vid, uint16_t queue_id)
>> if (vq == NULL)
>> return ret;
>>
>> - if (!vq->async)
>> - return ret;
>> -
>> if (!rte_spinlock_trylock(&vq->access_lock)) {
>> VHOST_LOG_CONFIG(DEBUG,
>> "(%s) failed to check in-flight packets. virtqueue busy.\n",
>> @@ -1897,6 +1894,9 @@ rte_vhost_async_get_inflight(int vid, uint16_t queue_id)
>> return ret;
>> }
>>
>> + if (!vq->async)
>> + return ret;
>
> Lock is still taken at this point.
>
> FYI, I'll post a series to instrument locks in vhost, soon.
Could you please send a v2 which does not return with the lock taken?
>> +
>> ret = vq->async->pkts_inflight_n;
>> rte_spinlock_unlock(&vq->access_lock);
>>
>
>
Thanks,
Maxime
More information about the stable
mailing list