diff options
| author | Maxime Coquelin <maxime.coquelin@redhat.com> | 2017-06-30 18:04:21 +0200 |
|---|---|---|
| committer | Michael S. Tsirkin <mst@redhat.com> | 2017-07-03 22:29:49 +0300 |
| commit | 384b557da1a44ce260cd0328c06a250507348f73 (patch) | |
| tree | 04307e9efcca4c3105516353f300aa1d843de672 /hw | |
| parent | 552a1e01a41d7c24397a83947cca94d8d66e5f49 (diff) | |
vhost: ensure vhost_ops are set before calling iotlb callback
This patch fixes a crash that happens when vhost-user iommu
support is enabled and vhost-user socket is closed.
When it happens, if an IOTLB invalidation notification is sent
by the IOMMU, vhost_ops's NULL pointer is dereferenced.
Signed-off-by: Maxime Coquelin <maxime.coquelin@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Diffstat (limited to 'hw')
| -rw-r--r-- | hw/virtio/vhost-backend.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/hw/virtio/vhost-backend.c b/hw/virtio/vhost-backend.c index 4e31de1686..cb055e8f21 100644 --- a/hw/virtio/vhost-backend.c +++ b/hw/virtio/vhost-backend.c @@ -309,7 +309,10 @@ int vhost_backend_update_device_iotlb(struct vhost_dev *dev, return -EINVAL; } - return dev->vhost_ops->vhost_send_device_iotlb_msg(dev, &imsg); + if (dev->vhost_ops && dev->vhost_ops->vhost_send_device_iotlb_msg) + return dev->vhost_ops->vhost_send_device_iotlb_msg(dev, &imsg); + + return -ENODEV; } int vhost_backend_invalidate_device_iotlb(struct vhost_dev *dev, @@ -321,7 +324,10 @@ int vhost_backend_invalidate_device_iotlb(struct vhost_dev *dev, imsg.size = len; imsg.type = VHOST_IOTLB_INVALIDATE; - return dev->vhost_ops->vhost_send_device_iotlb_msg(dev, &imsg); + if (dev->vhost_ops && dev->vhost_ops->vhost_send_device_iotlb_msg) + return dev->vhost_ops->vhost_send_device_iotlb_msg(dev, &imsg); + + return -ENODEV; } int vhost_backend_handle_iotlb_msg(struct vhost_dev *dev, |