diff options
| author | Yajun Wu <yajunw@nvidia.com> | 2022-05-26 06:48:51 +0300 |
|---|---|---|
| committer | Michael S. Tsirkin <mst@redhat.com> | 2022-06-16 12:54:58 -0400 |
| commit | b595d6272e9219bf70a9baf6d37f64045907f03b (patch) | |
| tree | 2a931115fd9961a21c80f998cad2a33db3a57899 /hw/virtio/vhost-user.c | |
| parent | 3afcbb7b8e3358501d8cd2cfa37ad8e696519032 (diff) | |
| download | focaccia-qemu-b595d6272e9219bf70a9baf6d37f64045907f03b.tar.gz focaccia-qemu-b595d6272e9219bf70a9baf6d37f64045907f03b.zip | |
virtio/vhost-user: Fix wrong vhost notifier GPtrArray size
In fetch_or_create_notifier, idx begins with 0. So the GPtrArray size
should be idx + 1 and g_ptr_array_set_size should be called with idx + 1.
This wrong GPtrArray size causes fetch_or_create_notifier return an invalid
address. Passing this invalid pointer to vhost_user_host_notifier_remove
causes assert fail:
qemu/include/qemu/int128.h:27: int128_get64: Assertion `r == a' failed.
shutting down, reason=crashed
Backends like dpdk-vdpa which sends out vhost notifier requests almost always
hit qemu crash.
Fixes: 503e355465 ("virtio/vhost-user: dynamically assign VhostUserHostNotifiers")
Signed-off-by: Yajun Wu <yajunw@nvidia.com>
Acked-by: Parav Pandit <parav@nvidia.com>
Change-Id: I87e0f7591ca9a59d210879b260704a2d9e9d6bcd
Message-Id: <20220526034851.683258-1-yajunw@nvidia.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Eddie Dong <eddie.dong@intel.com>
Diffstat (limited to 'hw/virtio/vhost-user.c')
| -rw-r--r-- | hw/virtio/vhost-user.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/hw/virtio/vhost-user.c b/hw/virtio/vhost-user.c index 0594178224..4b9be26e84 100644 --- a/hw/virtio/vhost-user.c +++ b/hw/virtio/vhost-user.c @@ -1525,7 +1525,7 @@ static VhostUserHostNotifier *fetch_or_create_notifier(VhostUserState *u, { VhostUserHostNotifier *n = NULL; if (idx >= u->notifiers->len) { - g_ptr_array_set_size(u->notifiers, idx); + g_ptr_array_set_size(u->notifiers, idx + 1); } n = g_ptr_array_index(u->notifiers, idx); |