From f6b3e8ea39d00d25ab979f7b24842dc24e263ed8 Mon Sep 17 00:00:00 2001
From: Jinhua Cao <caojinhua1@huawei.com>
Date: Thu, 10 Feb 2022 14:37:52 +0800
Subject: [PATCH] virtio: bugfix: check the value of caches before accessing it

Vring caches may be NULL in check_vring_avail_num() if
virtio_reset() is called at the same time, such as when
the virtual machine starts.
So check it before accessing it in vring_avail_idx().

Signed-off-by: Jinhua Cao <caojinhua1@huawei.com>
---
 hw/virtio/virtio.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index 1f78b74c00..d93ea62723 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -2800,8 +2800,19 @@ static const VMStateDescription vmstate_virtio = {
 static void check_vring_avail_num(VirtIODevice *vdev, int index)
 {
     uint16_t nheads;
+    VRingMemoryRegionCaches *caches;
 
     rcu_read_lock();
+    caches = qatomic_rcu_read(&vdev->vq[index].vring.caches);
+    if (caches == NULL) {
+        /*
+         * caches may be NULL if virtio_reset is called at the same time,
+         * such as when the virtual machine starts.
+         */
+        rcu_read_unlock();
+        return;
+    }
+
     /* Check it isn't doing strange things with descriptor numbers. */
     nheads = vring_avail_idx(&vdev->vq[index]) - vdev->vq[index].last_avail_idx;
     if (nheads > vdev->vq[index].vring.num) {
-- 
2.27.0