| Message ID | 20210923202946.23266-1-wenwux.ma@intel.com (mailing list archive) |
|---|---|
| State | Superseded, archived |
| Delegated to: | Maxime Coquelin |
| Headers | show |
| Series | examples/vhost: fix use-after-free on drain vhost | expand |
| Context | Check | Description |
|---|---|---|
| ci/iol-x86_64-compile-testing | success | Testing PASS |
| ci/iol-intel-Functional | success | Functional Testing PASS |
| ci/iol-intel-Performance | success | Performance Testing PASS |
| ci/iol-aarch64-compile-testing | success | Testing PASS |
| ci/iol-mellanox-Performance | success | Performance Testing PASS |
| ci/intel-Testing | success | Testing PASS |
| ci/Intel-compilation | success | Compilation OK |
| ci/checkpatch | success | coding style OK |
Hi Wenwu, > -----Original Message----- > From: Ma, WenwuX <wenwux.ma@intel.com> > Sent: Friday, September 24, 2021 4:30 AM > To: dev@dpdk.org > Cc: maxime.coquelin@redhat.com; Xia, Chenbo <chenbo.xia@intel.com>; Hu, Jiayu > <jiayu.hu@intel.com>; Yang, YvonneX <yvonnex.yang@intel.com>; Ma, WenwuX > <wenwux.ma@intel.com> > Subject: [PATCH] examples/vhost: fix use-after-free on drain vhost > > When a vdev is removed in destroy_device function, > the corresponding vhost_txbuff[vdev->vid] will also > be free, but the vhost_txbuff[vdev->vid] may still Free -> freed vhost_txbuff[vdev->vid] -> vhost TX buffer > be used in the drain_vhost function, which will cause > an error of heap-use-after-free. Therefore, before > accessing vhost_txbuff[vdev->vid], we need to check > whether the vdev has been removed, if so, let's skip > this vdev. This is a bug fix. Please add fix and cc-stable tag. Thanks, Chenbo > > Signed-off-by: Wenwu Ma <wenwux.ma@intel.com> > --- > examples/vhost/main.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/examples/vhost/main.c b/examples/vhost/main.c > index d0bf1f31e3..1f6f7be8e3 100644 > --- a/examples/vhost/main.c > +++ b/examples/vhost/main.c > @@ -916,6 +916,9 @@ drain_vhost_table(void) > uint64_t cur_tsc; > > TAILQ_FOREACH(vdev, &vhost_dev_list, global_vdev_entry) { > + if (unlikely(vdev->remove == 1)) > + continue; > + > vhost_txq = vhost_txbuff[lcore_id * MAX_VHOST_DEVICE > + vdev->vid]; > > -- > 2.25.1
diff --git a/examples/vhost/main.c b/examples/vhost/main.c index d0bf1f31e3..1f6f7be8e3 100644 --- a/examples/vhost/main.c +++ b/examples/vhost/main.c @@ -916,6 +916,9 @@ drain_vhost_table(void) uint64_t cur_tsc; TAILQ_FOREACH(vdev, &vhost_dev_list, global_vdev_entry) { + if (unlikely(vdev->remove == 1)) + continue; + vhost_txq = vhost_txbuff[lcore_id * MAX_VHOST_DEVICE + vdev->vid];
When a vdev is removed in destroy_device function, the corresponding vhost_txbuff[vdev->vid] will also be free, but the vhost_txbuff[vdev->vid] may still be used in the drain_vhost function, which will cause an error of heap-use-after-free. Therefore, before accessing vhost_txbuff[vdev->vid], we need to check whether the vdev has been removed, if so, let's skip this vdev. Signed-off-by: Wenwu Ma <wenwux.ma@intel.com> --- examples/vhost/main.c | 3 +++ 1 file changed, 3 insertions(+)