diff mbox series

examples/vhost: fix use-after-free on drain vhost

Message ID 20210923202946.23266-1-wenwux.ma@intel.com (mailing list archive)
State Superseded, archived
Delegated to: Maxime Coquelin
Headers
Series examples/vhost: fix use-after-free on drain vhost |

Checks

Context Check Description
ci/checkpatch success coding style OK
ci/Intel-compilation success Compilation OK
ci/intel-Testing success Testing PASS
ci/iol-mellanox-Performance success Performance Testing PASS
ci/iol-aarch64-compile-testing success Testing PASS
ci/iol-intel-Performance success Performance Testing PASS
ci/iol-intel-Functional success Functional Testing PASS
ci/iol-x86_64-compile-testing success Testing PASS

Commit Message

Ma, WenwuX Sept. 23, 2021, 8:29 p.m. UTC 
  When a vdev is removed in destroy_device function,
the corresponding vhost_txbuff[vdev->vid] will also
be free, but the vhost_txbuff[vdev->vid] may still
be used in the drain_vhost function, which will cause
an error of heap-use-after-free. Therefore, before
accessing vhost_txbuff[vdev->vid], we need to check
whether the vdev has been removed, if so, let's skip
this vdev.

Signed-off-by: Wenwu Ma <wenwux.ma@intel.com>
---
 examples/vhost/main.c | 3 +++
 1 file changed, 3 insertions(+)

Comments

Chenbo Xia Sept. 24, 2021, 2:22 a.m. UTC | #1 
Hi Wenwu,

> -----Original Message-----
> From: Ma, WenwuX <wenwux.ma@intel.com>
> Sent: Friday, September 24, 2021 4:30 AM
> To: dev@dpdk.org
> Cc: maxime.coquelin@redhat.com; Xia, Chenbo <chenbo.xia@intel.com>; Hu, Jiayu
> <jiayu.hu@intel.com>; Yang, YvonneX <yvonnex.yang@intel.com>; Ma, WenwuX
> <wenwux.ma@intel.com>
> Subject: [PATCH] examples/vhost: fix use-after-free on drain vhost
> 
> When a vdev is removed in destroy_device function,
> the corresponding vhost_txbuff[vdev->vid] will also
> be free, but the vhost_txbuff[vdev->vid] may still

Free -> freed

vhost_txbuff[vdev->vid] -> vhost TX buffer

> be used in the drain_vhost function, which will cause
> an error of heap-use-after-free. Therefore, before
> accessing vhost_txbuff[vdev->vid], we need to check
> whether the vdev has been removed, if so, let's skip
> this vdev.

This is a bug fix. Please add fix and cc-stable tag.

Thanks,
Chenbo

> 
> Signed-off-by: Wenwu Ma <wenwux.ma@intel.com>
> ---
>  examples/vhost/main.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/examples/vhost/main.c b/examples/vhost/main.c
> index d0bf1f31e3..1f6f7be8e3 100644
> --- a/examples/vhost/main.c
> +++ b/examples/vhost/main.c
> @@ -916,6 +916,9 @@ drain_vhost_table(void)
>  	uint64_t cur_tsc;
> 
>  	TAILQ_FOREACH(vdev, &vhost_dev_list, global_vdev_entry) {
> +		if (unlikely(vdev->remove == 1))
> +			continue;
> +
>  		vhost_txq = vhost_txbuff[lcore_id * MAX_VHOST_DEVICE
>  						+ vdev->vid];
> 
> --
> 2.25.1
diff mbox series

Patch

diff --git a/examples/vhost/main.c b/examples/vhost/main.c
index d0bf1f31e3..1f6f7be8e3 100644
--- a/examples/vhost/main.c
+++ b/examples/vhost/main.c
@@ -916,6 +916,9 @@  drain_vhost_table(void)
 	uint64_t cur_tsc;
 
 	TAILQ_FOREACH(vdev, &vhost_dev_list, global_vdev_entry) {
+		if (unlikely(vdev->remove == 1))
+			continue;
+
 		vhost_txq = vhost_txbuff[lcore_id * MAX_VHOST_DEVICE
 						+ vdev->vid];