[PATCH] net/vhost: fix null pointer dereference

[Wenwu Ma]

Because the async member of the vhost_virtqueue struct
can be freed in controlpath, so it should be protected
by spinlock in datapath, or, it may cause null pointer
dereference in the following vhost_poll_enqueue_completed().

Fixes: b737fd613969 ("vhost: add unsafe async API to clear packets")

Signed-off-by: Wenwu Ma <wenwux.ma at intel.com>
---
 lib/vhost/virtio_net.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/lib/vhost/virtio_net.c b/lib/vhost/virtio_net.c
index eed43658cf..858187d1b0 100644
--- a/lib/vhost/virtio_net.c
+++ b/lib/vhost/virtio_net.c
@@ -1911,16 +1911,22 @@ rte_vhost_poll_enqueue_completed(int vid, uint16_t queue_id,
 
 	vq = dev->virtqueue[queue_id];
 
+	if (!rte_spinlock_trylock(&vq->access_lock)) {
+		VHOST_LOG_DATA(DEBUG,
+			"%s: virtqueue %u is busy.\n",
+			__func__, queue_id);
+		return 0;
+	}
+
 	if (unlikely(!vq->async)) {
 		VHOST_LOG_DATA(ERR, "(%d) %s: async not registered for queue id %d.\n",
 			dev->vid, __func__, queue_id);
-		return 0;
+		goto out;
 	}
 
-	rte_spinlock_lock(&vq->access_lock);
-
 	n_pkts_cpl = vhost_poll_enqueue_completed(dev, queue_id, pkts, count);
 
+out:
 	rte_spinlock_unlock(&vq->access_lock);
 
 	return n_pkts_cpl;
-- 
2.25.1