vhost-net: Always access vq->private_data under vq mutex (2e26af79) · Commits · e / devices / android_kernel_samsung_universal8895

drivers/vhost/net.c

+10 −11

Original line number	Original line	Diff line number	Diff line
	@@ -346,12 +346,11 @@ static void handle_tx(struct vhost_net *net)
	struct vhost_net_ubuf_ref *uninitialized_var(ubufs);		struct vhost_net_ubuf_ref *uninitialized_var(ubufs);
	bool zcopy, zcopy_used;		bool zcopy, zcopy_used;

	/* TODO: check that we are running from vhost_worker? */		mutex_lock(&vq->mutex);
	sock = rcu_dereference_check(vq->private_data, 1);		sock = vq->private_data;
	if (!sock)		if (!sock)
	return;		goto out;

	mutex_lock(&vq->mutex);
	vhost_disable_notify(&net->dev, vq);		vhost_disable_notify(&net->dev, vq);

	hdr_size = nvq->vhost_hlen;		hdr_size = nvq->vhost_hlen;
	@@ -461,7 +460,7 @@ static void handle_tx(struct vhost_net *net)
	break;		break;
	}		}
	}		}
			out:
	mutex_unlock(&vq->mutex);		mutex_unlock(&vq->mutex);
	}		}

	@@ -570,14 +569,14 @@ static void handle_rx(struct vhost_net *net)
	s16 headcount;		s16 headcount;
	size_t vhost_hlen, sock_hlen;		size_t vhost_hlen, sock_hlen;
	size_t vhost_len, sock_len;		size_t vhost_len, sock_len;
	/* TODO: check that we are running from vhost_worker? */		struct socket *sock;
	struct socket *sock = rcu_dereference_check(vq->private_data, 1);

	if (!sock)
	return;

	mutex_lock(&vq->mutex);		mutex_lock(&vq->mutex);
			sock = vq->private_data;
			if (!sock)
			goto out;
	vhost_disable_notify(&net->dev, vq);		vhost_disable_notify(&net->dev, vq);

	vhost_hlen = nvq->vhost_hlen;		vhost_hlen = nvq->vhost_hlen;
	sock_hlen = nvq->sock_hlen;		sock_hlen = nvq->sock_hlen;

	@@ -652,7 +651,7 @@ static void handle_rx(struct vhost_net *net)
	break;		break;
	}		}
	}		}
			out:
	mutex_unlock(&vq->mutex);		mutex_unlock(&vq->mutex);
	}		}