From 2e4695cf4b8be18c1ad695ca04b59c4ebb5c8efc Mon Sep 17 00:00:00 2001 From: Maxime Coquelin Date: Thu, 31 Aug 2017 15:07:14 +0200 Subject: [PATCH 3/4] vhost: ensure vhost_ops are set before calling iotlb callback MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit RH-Author: Maxime Coquelin Message-id: <20170831150715.27421-2-maxime.coquelin@redhat.com> Patchwork-id: 76170 O-Subject: [RHV-7.4.z qemu-kvm-rhev PATCH 1/2] vhost: ensure vhost_ops are set before calling iotlb callback Bugzilla: 1480446 RH-Acked-by: Marc-André Lureau RH-Acked-by: Jens Freimann RH-Acked-by: Michael S. Tsirkin This patch fixes a crash that happens when vhost-user iommu support is enabled and vhost-user socket is closed. When it happens, if an IOTLB invalidation notification is sent by the IOMMU, vhost_ops's NULL pointer is dereferenced. Signed-off-by: Maxime Coquelin Reviewed-by: Marc-André Lureau Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin (cherry picked from commit 384b557da1a44ce260cd0328c06a250507348f73) Signed-off-by: Maxime Coquelin Signed-off-by: Miroslav Rezanina --- hw/virtio/vhost-backend.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/hw/virtio/vhost-backend.c b/hw/virtio/vhost-backend.c index 4e31de1..cb055e8 100644 --- a/hw/virtio/vhost-backend.c +++ b/hw/virtio/vhost-backend.c @@ -309,7 +309,10 @@ int vhost_backend_update_device_iotlb(struct vhost_dev *dev, return -EINVAL; } - return dev->vhost_ops->vhost_send_device_iotlb_msg(dev, &imsg); + if (dev->vhost_ops && dev->vhost_ops->vhost_send_device_iotlb_msg) + return dev->vhost_ops->vhost_send_device_iotlb_msg(dev, &imsg); + + return -ENODEV; } int vhost_backend_invalidate_device_iotlb(struct vhost_dev *dev, @@ -321,7 +324,10 @@ int vhost_backend_invalidate_device_iotlb(struct vhost_dev *dev, imsg.size = len; imsg.type = VHOST_IOTLB_INVALIDATE; - return dev->vhost_ops->vhost_send_device_iotlb_msg(dev, &imsg); + if (dev->vhost_ops && dev->vhost_ops->vhost_send_device_iotlb_msg) + return dev->vhost_ops->vhost_send_device_iotlb_msg(dev, &imsg); + + return -ENODEV; } int vhost_backend_handle_iotlb_msg(struct vhost_dev *dev, -- 1.8.3.1