aboutsummaryrefslogtreecommitdiff
path: root/hw/virtio
diff options
context:
space:
mode:
authorMaxime Coquelin <maxime.coquelin@redhat.com>2017-06-30 18:04:21 +0200
committerMichael S. Tsirkin <mst@redhat.com>2017-07-03 22:29:49 +0300
commit384b557da1a44ce260cd0328c06a250507348f73 (patch)
tree04307e9efcca4c3105516353f300aa1d843de672 /hw/virtio
parent552a1e01a41d7c24397a83947cca94d8d66e5f49 (diff)
downloadqemu-384b557da1a44ce260cd0328c06a250507348f73.zip
qemu-384b557da1a44ce260cd0328c06a250507348f73.tar.gz
qemu-384b557da1a44ce260cd0328c06a250507348f73.tar.bz2
vhost: ensure vhost_ops are set before calling iotlb callback
This patch fixes a crash that happens when vhost-user iommu support is enabled and vhost-user socket is closed. When it happens, if an IOTLB invalidation notification is sent by the IOMMU, vhost_ops's NULL pointer is dereferenced. Signed-off-by: Maxime Coquelin <maxime.coquelin@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Diffstat (limited to 'hw/virtio')
-rw-r--r--hw/virtio/vhost-backend.c10
1 files changed, 8 insertions, 2 deletions
diff --git a/hw/virtio/vhost-backend.c b/hw/virtio/vhost-backend.c
index 4e31de1..cb055e8 100644
--- a/hw/virtio/vhost-backend.c
+++ b/hw/virtio/vhost-backend.c
@@ -309,7 +309,10 @@ int vhost_backend_update_device_iotlb(struct vhost_dev *dev,
return -EINVAL;
}
- return dev->vhost_ops->vhost_send_device_iotlb_msg(dev, &imsg);
+ if (dev->vhost_ops && dev->vhost_ops->vhost_send_device_iotlb_msg)
+ return dev->vhost_ops->vhost_send_device_iotlb_msg(dev, &imsg);
+
+ return -ENODEV;
}
int vhost_backend_invalidate_device_iotlb(struct vhost_dev *dev,
@@ -321,7 +324,10 @@ int vhost_backend_invalidate_device_iotlb(struct vhost_dev *dev,
imsg.size = len;
imsg.type = VHOST_IOTLB_INVALIDATE;
- return dev->vhost_ops->vhost_send_device_iotlb_msg(dev, &imsg);
+ if (dev->vhost_ops && dev->vhost_ops->vhost_send_device_iotlb_msg)
+ return dev->vhost_ops->vhost_send_device_iotlb_msg(dev, &imsg);
+
+ return -ENODEV;
}
int vhost_backend_handle_iotlb_msg(struct vhost_dev *dev,