From: Philippe Mathieu-Daudé <philmd@redhat.com>
Date: Mon, 6 Sep 2021 10:43:17 +0000 (+0200)
Subject: hw/virtio: Acquire RCU read lock in virtqueue_packed_drop_all()
X-Git-Tag: v6.2.0-rc0~71^2~46
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ab4dd2746c234f038206b3ccfe6bec1f19f98c24;p=thirdparty%2Fqemu.git

hw/virtio: Acquire RCU read lock in virtqueue_packed_drop_all()

vring_get_region_caches() must be called with the RCU read lock
acquired. virtqueue_packed_drop_all() does not, and uses the
'caches' pointer. Fix that by using the RCU_READ_LOCK_GUARD()
macro.

Reported-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <20210906104318.1569967-3-philmd@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
---

diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index 240759ff0b7..dd0ab433b87 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -1703,6 +1703,8 @@ static unsigned int virtqueue_packed_drop_all(VirtQueue *vq)
     VirtIODevice *vdev = vq->vdev;
     VRingPackedDesc desc;
 
+    RCU_READ_LOCK_GUARD();
+
     caches = vring_get_region_caches(vq);
     if (!caches) {
         return 0;