diff mbox series

[v2] examples/vhost: fix use-after-free on drain vhost

Message ID 20210924172300.26245-1-wenwux.ma@intel.com (mailing list archive)
State New
Delegated to: Maxime Coquelin
Headers show
Series [v2] examples/vhost: fix use-after-free on drain vhost | expand

Checks

Context Check Description
ci/github-robot: build success github build: passed
ci/intel-Testing success Testing PASS
ci/Intel-compilation success Compilation OK
ci/iol-x86_64-compile-testing success Testing PASS
ci/iol-intel-Functional success Functional Testing PASS
ci/iol-intel-Performance success Performance Testing PASS
ci/iol-mellanox-Performance success Performance Testing PASS
ci/iol-aarch64-compile-testing success Testing PASS
ci/checkpatch success coding style OK

Commit Message

Wenwu Ma Sept. 24, 2021, 5:23 p.m. UTC
When a vdev is removed in destroy_device function,
the corresponding vhost TX buffer will also be freed,
but the vhost TX buffer may still be used in the
drain_vhost function, which will cause an error of
heap-use-after-free. Therefore, before accessing
vhost TX buffer, we need to check whether the vdev
has been removed, if so, let's skip this vdev.

Fixes: a68ba8e0a6b6 ("examples/vhost: refactor vhost data path")
Cc: stable@dpdk.org

Signed-off-by: Wenwu Ma <wenwux.ma@intel.com>
---
 examples/vhost/main.c | 3 +++
 1 file changed, 3 insertions(+)

Comments

Xia, Chenbo Sept. 29, 2021, 7:23 a.m. UTC | #1
> -----Original Message-----
> From: Ma, WenwuX <wenwux.ma@intel.com>
> Sent: Saturday, September 25, 2021 1:23 AM
> To: dev@dpdk.org
> Cc: maxime.coquelin@redhat.com; Xia, Chenbo <chenbo.xia@intel.com>; Jiang,
> Cheng1 <cheng1.jiang@intel.com>; Hu, Jiayu <jiayu.hu@intel.com>; Yang, YvonneX
> <yvonnex.yang@intel.com>; Ma, WenwuX <wenwux.ma@intel.com>; stable@dpdk.org
> Subject: [PATCH v2] examples/vhost: fix use-after-free on drain vhost
> 
> When a vdev is removed in destroy_device function,
> the corresponding vhost TX buffer will also be freed,
> but the vhost TX buffer may still be used in the
> drain_vhost function, which will cause an error of
> heap-use-after-free. Therefore, before accessing
> vhost TX buffer, we need to check whether the vdev
> has been removed, if so, let's skip this vdev.
> 
> Fixes: a68ba8e0a6b6 ("examples/vhost: refactor vhost data path")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Wenwu Ma <wenwux.ma@intel.com>
> ---

Reviewed-by: Chenbo Xia <chenbo.xia@intel.com>
diff mbox series

Patch

diff --git a/examples/vhost/main.c b/examples/vhost/main.c
index d0bf1f31e3..1f6f7be8e3 100644
--- a/examples/vhost/main.c
+++ b/examples/vhost/main.c
@@ -916,6 +916,9 @@  drain_vhost_table(void)
 	uint64_t cur_tsc;
 
 	TAILQ_FOREACH(vdev, &vhost_dev_list, global_vdev_entry) {
+		if (unlikely(vdev->remove == 1))
+			continue;
+
 		vhost_txq = vhost_txbuff[lcore_id * MAX_VHOST_DEVICE
 						+ vdev->vid];