[PATCH] virtio: check if avail ring is configured

[PATCH] virtio: check if avail ring is configured

[Laurent Vivier]

If the connection to the vhost-user front end is closed during transfers
virtio rings are deconfigured and not available anymore, but we can
try to access them to process queued data. This can trigger a SIGSEG as
we try to access unavailable memory.
To fix that check vq->vring.avail is sane before accessing the vring

Signed-off-by: Laurent Vivier <lvivier@redhat.com>
---
 virtio.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/virtio.c b/virtio.c
index 6a97435e2965..0598ff479858 100644
--- a/virtio.c
+++ b/virtio.c
@@ -284,6 +284,9 @@ static int virtqueue_read_next_desc(const struct vring_desc *desc,
  */
 bool vu_queue_empty(struct vu_virtq *vq)
 {
+	if (!vq->vring.avail)
+		return true;
+
 	if (vq->shadow_avail_idx != vq->last_avail_idx)
 		return false;
 
@@ -327,6 +330,9 @@ static bool vring_can_notify(const struct vu_dev *dev, struct vu_virtq *vq)
  */
 void vu_queue_notify(const struct vu_dev *dev, struct vu_virtq *vq)
 {
+	if (!vq->vring.avail)
+		return;
+
 	if (!vring_can_notify(dev, vq)) {
 		debug("vhost-user: virtqueue can skip notify...");
 		return;
@@ -502,6 +508,9 @@ int vu_queue_pop(struct vu_dev *dev, struct vu_virtq *vq, struct vu_virtq_elemen
 	unsigned int head;
 	int ret;
 
+	if (!vq->vring.avail)
+		return -1;
+
 	if (vu_queue_empty(vq))
 		return -1;
 
@@ -591,6 +600,9 @@ void vu_queue_fill_by_index(struct vu_virtq *vq, unsigned int index,
 {
 	struct vring_used_elem uelem;
 
+	if (!vq->vring.avail)
+		return;
+
 	idx = (idx + vq->used_idx) % vq->vring.num;
 
 	uelem.id = htole32(index);
@@ -633,6 +645,9 @@ void vu_queue_flush(struct vu_virtq *vq, unsigned int count)
 {
 	uint16_t old, new;
 
+	if (!vq->vring.avail)
+		return;
+
 	/* Make sure buffer is written before we update index. */
 	smp_wmb();
 
-- 
@@ -284,6 +284,9 @@ static int virtqueue_read_next_desc(const struct vring_desc *desc,
  */
 bool vu_queue_empty(struct vu_virtq *vq)
 {
+	if (!vq->vring.avail)
+		return true;
+
 	if (vq->shadow_avail_idx != vq->last_avail_idx)
 		return false;
 
@@ -327,6 +330,9 @@ static bool vring_can_notify(const struct vu_dev *dev, struct vu_virtq *vq)
  */
 void vu_queue_notify(const struct vu_dev *dev, struct vu_virtq *vq)
 {
+	if (!vq->vring.avail)
+		return;
+
 	if (!vring_can_notify(dev, vq)) {
 		debug("vhost-user: virtqueue can skip notify...");
 		return;
@@ -502,6 +508,9 @@ int vu_queue_pop(struct vu_dev *dev, struct vu_virtq *vq, struct vu_virtq_elemen
 	unsigned int head;
 	int ret;
 
+	if (!vq->vring.avail)
+		return -1;
+
 	if (vu_queue_empty(vq))
 		return -1;
 
@@ -591,6 +600,9 @@ void vu_queue_fill_by_index(struct vu_virtq *vq, unsigned int index,
 {
 	struct vring_used_elem uelem;
 
+	if (!vq->vring.avail)
+		return;
+
 	idx = (idx + vq->used_idx) % vq->vring.num;
 
 	uelem.id = htole32(index);
@@ -633,6 +645,9 @@ void vu_queue_flush(struct vu_virtq *vq, unsigned int count)
 {
 	uint16_t old, new;
 
+	if (!vq->vring.avail)
+		return;
+
 	/* Make sure buffer is written before we update index. */
 	smp_wmb();
 
-- 
2.47.0