From patchwork Fri Sep 24 17:23:00 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Ma, WenwuX" X-Patchwork-Id: 99534 X-Patchwork-Delegate: maxime.coquelin@redhat.com Return-Path: X-Original-To: patchwork@inbox.dpdk.org Delivered-To: patchwork@inbox.dpdk.org Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id D8223A0C43; Fri, 24 Sep 2021 07:30:48 +0200 (CEST) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 7DE4D40687; Fri, 24 Sep 2021 07:30:48 +0200 (CEST) Received: from mga17.intel.com (mga17.intel.com [192.55.52.151]) by mails.dpdk.org (Postfix) with ESMTP id 021F340142; Fri, 24 Sep 2021 07:30:46 +0200 (CEST) X-IronPort-AV: E=McAfee;i="6200,9189,10116"; a="204161731" X-IronPort-AV: E=Sophos;i="5.85,319,1624345200"; d="scan'208";a="204161731" Received: from fmsmga003.fm.intel.com ([10.253.24.29]) by fmsmga107.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 23 Sep 2021 22:30:45 -0700 X-IronPort-AV: E=Sophos;i="5.85,319,1624345200"; d="scan'208";a="551437954" Received: from unknown (HELO localhost.localdomain) ([10.240.183.109]) by fmsmga003-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 23 Sep 2021 22:30:42 -0700 From: Wenwu Ma To: dev@dpdk.org Cc: maxime.coquelin@redhat.com, chenbo.xia@intel.com, cheng1.jiang@intel.com, jiayu.hu@intel.com, yvonnex.yang@intel.com, Wenwu Ma , stable@dpdk.org Date: Fri, 24 Sep 2021 17:23:00 +0000 Message-Id: <20210924172300.26245-1-wenwux.ma@intel.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20210923202946.23266-1-wenwux.ma@intel.com> References: <20210923202946.23266-1-wenwux.ma@intel.com> MIME-Version: 1.0 Subject: [dpdk-dev] [PATCH v2] examples/vhost: fix use-after-free on drain vhost X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" When a vdev is removed in destroy_device function, the corresponding vhost TX buffer will also be freed, but the vhost TX buffer may still be used in the drain_vhost function, which will cause an error of heap-use-after-free. Therefore, before accessing vhost TX buffer, we need to check whether the vdev has been removed, if so, let's skip this vdev. Fixes: a68ba8e0a6b6 ("examples/vhost: refactor vhost data path") Cc: stable@dpdk.org Signed-off-by: Wenwu Ma Reviewed-by: Chenbo Xia --- examples/vhost/main.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/examples/vhost/main.c b/examples/vhost/main.c index d0bf1f31e3..1f6f7be8e3 100644 --- a/examples/vhost/main.c +++ b/examples/vhost/main.c @@ -916,6 +916,9 @@ drain_vhost_table(void) uint64_t cur_tsc; TAILQ_FOREACH(vdev, &vhost_dev_list, global_vdev_entry) { + if (unlikely(vdev->remove == 1)) + continue; + vhost_txq = vhost_txbuff[lcore_id * MAX_VHOST_DEVICE + vdev->vid];