Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/130870/?format=api
{ "id": 130870, "url": "http://patches.dpdk.org/api/patches/130870/?format=api", "web_url": "http://patches.dpdk.org/project/dpdk/patch/20230830084708.754084-1-fengli@smartx.com/", "project": { "id": 1, "url": "http://patches.dpdk.org/api/projects/1/?format=api", "name": "DPDK", "link_name": "dpdk", "list_id": "dev.dpdk.org", "list_email": "dev@dpdk.org", "web_url": "http://core.dpdk.org", "scm_url": "git://dpdk.org/dpdk", "webscm_url": "http://git.dpdk.org/dpdk", "list_archive_url": "https://inbox.dpdk.org/dev", "list_archive_url_format": "https://inbox.dpdk.org/dev/{}", "commit_url_format": "" }, "msgid": "<20230830084708.754084-1-fengli@smartx.com>", "list_archive_url": "https://inbox.dpdk.org/dev/20230830084708.754084-1-fengli@smartx.com", "date": "2023-08-30T08:47:08", "name": "vhost: avoid potential null pointer access", "commit_ref": null, "pull_url": null, "state": "superseded", "archived": true, "hash": "591ee26bea46934cb18cfc0101b64e91aa30e02e", "submitter": { "id": 1528, "url": "http://patches.dpdk.org/api/people/1528/?format=api", "name": "Li Feng", "email": "fengli@smartx.com" }, "delegate": { "id": 2642, "url": "http://patches.dpdk.org/api/users/2642/?format=api", "username": "mcoquelin", "first_name": "Maxime", "last_name": "Coquelin", "email": "maxime.coquelin@redhat.com" }, "mbox": "http://patches.dpdk.org/project/dpdk/patch/20230830084708.754084-1-fengli@smartx.com/mbox/", "series": [ { "id": 29367, "url": "http://patches.dpdk.org/api/series/29367/?format=api", "web_url": "http://patches.dpdk.org/project/dpdk/list/?series=29367", "date": "2023-08-30T08:47:08", "name": "vhost: avoid potential null pointer access", "version": 1, "mbox": "http://patches.dpdk.org/series/29367/mbox/" } ], "comments": "http://patches.dpdk.org/api/patches/130870/comments/", "check": "fail", "checks": "http://patches.dpdk.org/api/patches/130870/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<dev-bounces@dpdk.org>", "X-Original-To": "patchwork@inbox.dpdk.org", "Delivered-To": "patchwork@inbox.dpdk.org", "Received": [ "from mails.dpdk.org (mails.dpdk.org [217.70.189.124])\n\tby inbox.dpdk.org (Postfix) with ESMTP id 14EEC41FCB;\n\tWed, 30 Aug 2023 10:47:41 +0200 (CEST)", "from mails.dpdk.org (localhost [127.0.0.1])\n\tby mails.dpdk.org (Postfix) with ESMTP id A92DF40279;\n\tWed, 30 Aug 2023 10:47:40 +0200 (CEST)", "from mail-pf1-f177.google.com (mail-pf1-f177.google.com\n [209.85.210.177])\n by mails.dpdk.org (Postfix) with ESMTP id 5E92540277\n for <dev@dpdk.org>; Wed, 30 Aug 2023 10:47:39 +0200 (CEST)", "by mail-pf1-f177.google.com with SMTP id\n d2e1a72fcca58-68a3cae6d94so4575022b3a.0\n for <dev@dpdk.org>; Wed, 30 Aug 2023 01:47:39 -0700 (PDT)", "from 64217.gitgo.cc ([8.210.91.195])\n by smtp.gmail.com with ESMTPSA id\n 21-20020aa79255000000b006887b72ba38sm9645709pfp.164.2023.08.30.01.47.36\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Wed, 30 Aug 2023 01:47:37 -0700 (PDT)" ], "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=smartx-com.20221208.gappssmtp.com; s=20221208; t=1693385258; x=1693990058;\n darn=dpdk.org;\n h=content-transfer-encoding:mime-version:message-id:date:subject:cc\n :to:from:from:to:cc:subject:date:message-id:reply-to;\n bh=FZfpubqq5hiYA6LFBLdgDovPV9S9/O2Tid0aog5TU8M=;\n b=HFtLSNZQKVrM2yADeCrDnVP5cMq3uNUvwvKorr74QFqPQqg//qBSI9A5CzE4AK4bBY\n nyhZCPNRVY9M1PbEwKddSmSX8geq4AQUwyq/Eb/xN7aTYAd6INHTS0FQG3ZeJ+yiF5il\n mfa7P00sjbzDa8Vi2GQVN2a+IcSwhbpEuWgrG++946fajsQTRqDba30TBgpe5vPmGvKv\n wRhvwxVxPnFsCOgeNelCeg+dMUPoIk7kbWc2o37MoyYAq85lBoiaTBetAf87aFQSptkc\n YNDsAtBCrado414NMpNlj6T1Abz0r6lf2xZgw3UK0mxh9O8RM6kO1PCjUpbvcc7JHIjg\n ZSYw==", "X-Google-DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20221208; t=1693385258; x=1693990058;\n h=content-transfer-encoding:mime-version:message-id:date:subject:cc\n :to:from:x-gm-message-state:from:to:cc:subject:date:message-id\n :reply-to;\n bh=FZfpubqq5hiYA6LFBLdgDovPV9S9/O2Tid0aog5TU8M=;\n b=HW+jxE3JeCFDfA9vAzegN/vjBpkPJ8PdN25puBlouSist2SD0DING3MNZEJB+4xqc8\n cDqY61oaXAk82E00I/Bz6afBGgNgXti0O/h6KGiF80B+G5cZlIdDnfToi4BuIN+RhQsz\n eZEc6uZlJSAp6xxyR457V5jcBNpO6IgSy5cUizY7yUMjuXx/Mg9HWb71ssbz/xLPLXct\n CPmmMMcojq6tAa2AeLGeXSmoCry62J/508rrpCsiyEuqsjQe9lOH9thWG7FxAhIO84Z8\n huneK5Hv3D0p0PmyPhYp1RBLUxakyidU/BqhSxIEFnxA0ca9uko0athLWH1Wvc/gVMaw\n rfmQ==", "X-Gm-Message-State": "AOJu0Yychw+oaPKJD8CrPi+4WZBk9UIAey6Dwq18kmEOQ3l/fcBwmOCr\n WwQvzaQLiTnxCuB7aEl60fj1/g==", "X-Google-Smtp-Source": "\n AGHT+IG3dFAX8tBE/9XjTUVRHg6jbeYI++K7TjOmDOCRMHVA0S15ONr7U+++6ZmD1ahj+zvBcklKFw==", "X-Received": "by 2002:a05:6a00:a28:b0:68a:4d66:ca1 with SMTP id\n p40-20020a056a000a2800b0068a4d660ca1mr1950804pfh.6.1693385258079;\n Wed, 30 Aug 2023 01:47:38 -0700 (PDT)", "From": "Li Feng <fengli@smartx.com>", "To": "Maxime Coquelin <maxime.coquelin@redhat.com>,\n Chenbo Xia <chenbo.xia@intel.com>", "Cc": "dev@dpdk.org,\n\tLi Feng <fengli@smartx.com>", "Subject": "[PATCH] vhost: avoid potential null pointer access", "Date": "Wed, 30 Aug 2023 16:47:08 +0800", "Message-ID": "<20230830084708.754084-1-fengli@smartx.com>", "X-Mailer": "git-send-email 2.41.0", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit", "X-BeenThere": "dev@dpdk.org", "X-Mailman-Version": "2.1.29", "Precedence": "list", "List-Id": "DPDK patches and discussions <dev.dpdk.org>", "List-Unsubscribe": "<https://mails.dpdk.org/options/dev>,\n <mailto:dev-request@dpdk.org?subject=unsubscribe>", "List-Archive": "<http://mails.dpdk.org/archives/dev/>", "List-Post": "<mailto:dev@dpdk.org>", "List-Help": "<mailto:dev-request@dpdk.org?subject=help>", "List-Subscribe": "<https://mails.dpdk.org/listinfo/dev>,\n <mailto:dev-request@dpdk.org?subject=subscribe>", "Errors-To": "dev-bounces@dpdk.org" }, "content": "If the user calls rte_vhost_vring_call() on a ring that has been\ninvalidated, we will encounter SEGV.\n\nWe should check the pointer firstly before accessing it.\n\nSigned-off-by: Li Feng <fengli@smartx.com>\n---\n lib/vhost/vhost.c | 7 ++++---\n lib/vhost/vhost.h | 12 ++++++++++--\n 2 files changed, 14 insertions(+), 5 deletions(-)", "diff": "diff --git a/lib/vhost/vhost.c b/lib/vhost/vhost.c\nindex eb6309b681..3af0307cd6 100644\n--- a/lib/vhost/vhost.c\n+++ b/lib/vhost/vhost.c\n@@ -1327,6 +1327,7 @@ rte_vhost_vring_call(int vid, uint16_t vring_idx)\n {\n \tstruct virtio_net *dev;\n \tstruct vhost_virtqueue *vq;\n+\tint ret = 0;\n \n \tdev = get_device(vid);\n \tif (!dev)\n@@ -1342,13 +1343,13 @@ rte_vhost_vring_call(int vid, uint16_t vring_idx)\n \trte_rwlock_read_lock(&vq->access_lock);\n \n \tif (vq_is_packed(dev))\n-\t\tvhost_vring_call_packed(dev, vq);\n+\t\tret = vhost_vring_call_packed(dev, vq);\n \telse\n-\t\tvhost_vring_call_split(dev, vq);\n+\t\tret = vhost_vring_call_split(dev, vq);\n \n \trte_rwlock_read_unlock(&vq->access_lock);\n \n-\treturn 0;\n+\treturn ret;\n }\n \n int\ndiff --git a/lib/vhost/vhost.h b/lib/vhost/vhost.h\nindex 9723429b1c..f38e6d16c9 100644\n--- a/lib/vhost/vhost.h\n+++ b/lib/vhost/vhost.h\n@@ -930,7 +930,7 @@ vhost_vring_inject_irq(struct virtio_net *dev, struct vhost_virtqueue *vq)\n \t\tdev->notify_ops->guest_notified(dev->vid);\n }\n \n-static __rte_always_inline void\n+static __rte_always_inline int\n vhost_vring_call_split(struct virtio_net *dev, struct vhost_virtqueue *vq)\n {\n \t/* Flush used->idx update before we read avail->flags. */\n@@ -953,13 +953,17 @@ vhost_vring_call_split(struct virtio_net *dev, struct vhost_virtqueue *vq)\n \t\t\t\tunlikely(!signalled_used_valid))\n \t\t\tvhost_vring_inject_irq(dev, vq);\n \t} else {\n+\t\tif (!vq->avail)\n+\t\t\treturn -1;\n+\n \t\t/* Kick the guest if necessary. */\n \t\tif (!(vq->avail->flags & VRING_AVAIL_F_NO_INTERRUPT))\n \t\t\tvhost_vring_inject_irq(dev, vq);\n \t}\n+\treturn 0;\n }\n \n-static __rte_always_inline void\n+static __rte_always_inline int\n vhost_vring_call_packed(struct virtio_net *dev, struct vhost_virtqueue *vq)\n {\n \tuint16_t old, new, off, off_wrap;\n@@ -968,6 +972,9 @@ vhost_vring_call_packed(struct virtio_net *dev, struct vhost_virtqueue *vq)\n \t/* Flush used desc update. */\n \trte_atomic_thread_fence(__ATOMIC_SEQ_CST);\n \n+\tif (!vq->driver_event)\n+\t\treturn -1;\n+\n \tif (!(dev->features & (1ULL << VIRTIO_RING_F_EVENT_IDX))) {\n \t\tif (vq->driver_event->flags !=\n \t\t\t\tVRING_EVENT_F_DISABLE)\n@@ -1030,6 +1037,7 @@ restore_mbuf(struct rte_mbuf *m)\n \t\trte_mbuf_iova_set(m, rte_mempool_virt2iova(m) + mbuf_size);\n \t\tm = m->next;\n \t}\n+\treturn 0;\n }\n \n static __rte_always_inline bool\n", "prefixes": [] }