From 41aa66e37d04246d48b5417c57967425ecc466a0 Mon Sep 17 00:00:00 2001
From: Jinhua Cao <caojinhua1@huawei.com>
Date: Thu, 10 Feb 2022 11:16:26 +0800
Subject: [PATCH] virtio: bugfix: add rcu_read_lock when vring_avail_idx is
 called

viring_avail_idx should be called within rcu_read_lock(),
or may get NULL caches in vring_get_region_caches() and
trigger assert().

Signed-off-by: Jinhua Cao <caojinhua1@huawei.com>
---
 hw/virtio/virtio.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index 007f4c9e26..0af9684881 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -2864,6 +2864,7 @@ static void check_vring_avail_num(VirtIODevice *vdev, int index)
 {
     uint16_t nheads;
 
+    rcu_read_lock();
     /* Check it isn't doing strange things with descriptor numbers. */
     nheads = vring_avail_idx(&vdev->vq[index]) - vdev->vq[index].last_avail_idx;
     if (nheads > vdev->vq[index].vring.num) {
@@ -2874,6 +2875,7 @@ static void check_vring_avail_num(VirtIODevice *vdev, int index)
                  vring_avail_idx(&vdev->vq[index]),
                  vdev->vq[index].last_avail_idx, nheads);
     }
+    rcu_read_unlock();
 }
 
 int virtio_save(VirtIODevice *vdev, QEMUFile *f)
-- 
2.27.0