NULL check for vq->async must be protected by lock. Otherwise, it is possible that the data plane thread dereferences vq->async with NULL value, since the control plane thread is freeing vq->async.
Fixes: ee8024b3d4ad (vhost: move async data in dedicated structure) Cc: sta...@dpdk.org Signed-off-by: Jiayu Hu <jiayu...@intel.com> --- lib/vhost/vhost.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lib/vhost/vhost.c b/lib/vhost/vhost.c index bc88148347..7f60c2824f 100644 --- a/lib/vhost/vhost.c +++ b/lib/vhost/vhost.c @@ -1887,9 +1887,6 @@ rte_vhost_async_get_inflight(int vid, uint16_t queue_id) if (vq == NULL) return ret; - if (!vq->async) - return ret; - if (!rte_spinlock_trylock(&vq->access_lock)) { VHOST_LOG_CONFIG(DEBUG, "(%s) failed to check in-flight packets. virtqueue busy.\n", @@ -1897,6 +1894,9 @@ rte_vhost_async_get_inflight(int vid, uint16_t queue_id) return ret; } + if (!vq->async) + return ret; + ret = vq->async->pkts_inflight_n; rte_spinlock_unlock(&vq->access_lock); -- 2.25.1