4d1ccc17f4
Not checking this can lead to invalid dev->vdev member access in
vhost_device_iotlb_miss if backend issue an iotlb message in a bad
timing, either maliciously or by a bug.
Reproduced rebooting a guest with testpmd in txonly forward mode.
#0 0x0000559ffff94394 in vhost_device_iotlb_miss (
dev=dev@entry=0x55a0012f6680, iova=10245279744, write=1)
at ../hw/virtio/vhost.c:1013
#1 0x0000559ffff9ac31 in vhost_backend_handle_iotlb_msg (
imsg=0x7ffddcfd32c0, dev=0x55a0012f6680)
at ../hw/virtio/vhost-backend.c:411
#2 vhost_backend_handle_iotlb_msg (dev=dev@entry=0x55a0012f6680,
imsg=imsg@entry=0x7ffddcfd32c0)
at ../hw/virtio/vhost-backend.c:404
#3 0x0000559fffeded7b in slave_read (opaque=0x55a0012f6680)
at ../hw/virtio/vhost-user.c:1464
#4 0x000055a0000c541b in aio_dispatch_handler (
ctx=ctx@entry=0x55a0010a2120, node=0x55a0012d9e00)
at ../util/aio-posix.c:329
Fixes:
|
||
|---|---|---|
| .. | ||
| Kconfig | ||
| meson.build | ||
| trace-events | ||
| trace.h | ||
| vhost-backend.c | ||
| vhost-scsi-pci.c | ||
| vhost-stub.c | ||
| vhost-user-blk-pci.c | ||
| vhost-user-fs-pci.c | ||
| vhost-user-fs.c | ||
| vhost-user-input-pci.c | ||
| vhost-user-scsi-pci.c | ||
| vhost-user-vsock-pci.c | ||
| vhost-user-vsock.c | ||
| vhost-user.c | ||
| vhost-vdpa.c | ||
| vhost-vsock-common.c | ||
| vhost-vsock-pci.c | ||
| vhost-vsock.c | ||
| vhost.c | ||
| virtio-9p-pci.c | ||
| virtio-balloon-pci.c | ||
| virtio-balloon.c | ||
| virtio-blk-pci.c | ||
| virtio-bus.c | ||
| virtio-crypto-pci.c | ||
| virtio-crypto.c | ||
| virtio-input-host-pci.c | ||
| virtio-input-pci.c | ||
| virtio-iommu-pci.c | ||
| virtio-iommu.c | ||
| virtio-mem-pci.c | ||
| virtio-mem-pci.h | ||
| virtio-mem.c | ||
| virtio-mmio.c | ||
| virtio-net-pci.c | ||
| virtio-pci.c | ||
| virtio-pci.h | ||
| virtio-pmem-pci.c | ||
| virtio-pmem-pci.h | ||
| virtio-pmem.c | ||
| virtio-rng-pci.c | ||
| virtio-rng.c | ||
| virtio-scsi-pci.c | ||
| virtio-serial-pci.c | ||
| virtio.c | ||