qemu-devel.nongnu.org archive mirror
 help / color / mirror / Atom feed
* [Qemu-devel] [PATCH 1/2] libvhost-user: fix vu_queue_get_avail_bytes() crash
@ 2017-05-03 12:11 Marc-André Lureau
  2017-05-03 12:11 ` [Qemu-devel] [PATCH 2/2] libvhost-user: make vu_queue_empty() safer Marc-André Lureau
                   ` (2 more replies)
  0 siblings, 3 replies; 7+ messages in thread
From: Marc-André Lureau @ 2017-05-03 12:11 UTC (permalink / raw)
  To: qemu-devel; +Cc: dgilbert, mst, Marc-André Lureau

Calling vu_queue_get_avail_bytes() when the queue doesn't yet have
addresses will result in the following crash:

Program received signal SIGSEGV, Segmentation fault.
0x000055c414112ce4 in vring_avail_idx (vq=0x55c41582fd68, vq=0x55c41582fd68)
    at /home/dgilbert/git/qemu/contrib/libvhost-user/libvhost-user.c:940
940            vq->shadow_avail_idx = vq->vring.avail->idx;
(gdb) p vq
$1 = (VuVirtq *) 0x55c41582fd68
(gdb) p vq->vring
$2 = {num = 0, desc = 0x0, avail = 0x0, used = 0x0, log_guest_addr = 0, flags = 0}

    at /home/dgilbert/git/qemu/contrib/libvhost-user/libvhost-user.c:940
No locals.
    at /home/dgilbert/git/qemu/contrib/libvhost-user/libvhost-user.c:960
        num_heads = <optimized out>
    out_bytes=out_bytes@entry=0x7fffd035d7c4, max_in_bytes=max_in_bytes@entry=0,
    max_out_bytes=max_out_bytes@entry=0) at /home/dgilbert/git/qemu/contrib/libvhost-user/libvhost-user.c:1034

Check if vring.avail != null before accessing it.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 contrib/libvhost-user/libvhost-user.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/contrib/libvhost-user/libvhost-user.c b/contrib/libvhost-user/libvhost-user.c
index af4faad60b..f9680b6279 100644
--- a/contrib/libvhost-user/libvhost-user.c
+++ b/contrib/libvhost-user/libvhost-user.c
@@ -1031,6 +1031,10 @@ vu_queue_get_avail_bytes(VuDev *dev, VuVirtq *vq, unsigned int *in_bytes,
     idx = vq->last_avail_idx;
 
     total_bufs = in_total = out_total = 0;
+    if (!vq->vring.avail) {
+        goto done;
+    }
+
     while ((rc = virtqueue_num_heads(dev, vq, idx)) > 0) {
         unsigned int max, num_bufs, indirect = 0;
         struct vring_desc *desc;
-- 
2.12.0.191.gc5d8de91d

^ permalink raw reply related	[flat|nested] 7+ messages in thread

end of thread, other threads:[~2017-05-03 14:56 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-05-03 12:11 [Qemu-devel] [PATCH 1/2] libvhost-user: fix vu_queue_get_avail_bytes() crash Marc-André Lureau
2017-05-03 12:11 ` [Qemu-devel] [PATCH 2/2] libvhost-user: make vu_queue_empty() safer Marc-André Lureau
2017-05-03 12:27   ` Philippe Mathieu-Daudé
2017-05-03 12:26 ` [Qemu-devel] [PATCH 1/2] libvhost-user: fix vu_queue_get_avail_bytes() crash Philippe Mathieu-Daudé
2017-05-03 12:32   ` Marc-André Lureau
2017-05-03 12:57     ` Philippe Mathieu-Daudé
2017-05-03 14:56 ` Dr. David Alan Gilbert

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).