[PATCH] vhost: fix null pointer dereference

Jiayu Hu jiayu.hu at intel.com
Mon Mar 28 04:07:54 CEST 2022


NULL check for vq->async must be protected by lock. Otherwise, it is
possible that the data plane thread dereferences vq->async with NULL
value, since the control plane thread is freeing vq->async.

Fixes: ee8024b3d4ad (vhost: move async data in dedicated structure)
Cc: stable at dpdk.org

Signed-off-by: Jiayu Hu <jiayu.hu at intel.com>
---
 lib/vhost/vhost.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/vhost/vhost.c b/lib/vhost/vhost.c
index bc88148347..7f60c2824f 100644
--- a/lib/vhost/vhost.c
+++ b/lib/vhost/vhost.c
@@ -1887,9 +1887,6 @@ rte_vhost_async_get_inflight(int vid, uint16_t queue_id)
 	if (vq == NULL)
 		return ret;
 
-	if (!vq->async)
-		return ret;
-
 	if (!rte_spinlock_trylock(&vq->access_lock)) {
 		VHOST_LOG_CONFIG(DEBUG,
 			"(%s) failed to check in-flight packets. virtqueue busy.\n",
@@ -1897,6 +1894,9 @@ rte_vhost_async_get_inflight(int vid, uint16_t queue_id)
 		return ret;
 	}
 
+	if (!vq->async)
+		return ret;
+
 	ret = vq->async->pkts_inflight_n;
 	rte_spinlock_unlock(&vq->access_lock);
 
-- 
2.25.1



More information about the dev mailing list