From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from dpdk.org (dpdk.org [92.243.14.124]) by inbox.dpdk.org (Postfix) with ESMTP id 78ECDA00E6 for ; Fri, 9 Aug 2019 13:13:35 +0200 (CEST) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id 68B852AB; Fri, 9 Aug 2019 13:13:35 +0200 (CEST) Received: from mga18.intel.com (mga18.intel.com [134.134.136.126]) by dpdk.org (Postfix) with ESMTP id 20E4329CB for ; Fri, 9 Aug 2019 13:13:33 +0200 (CEST) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga005.fm.intel.com ([10.253.24.32]) by orsmga106.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 09 Aug 2019 04:13:33 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.64,364,1559545200"; d="scan'208";a="374461371" Received: from dpdk-virtio-tbie-2.sh.intel.com ([10.67.104.71]) by fmsmga005.fm.intel.com with ESMTP; 09 Aug 2019 04:13:30 -0700 From: Tiwei Bie To: yskoh@mellanox.com, stable@dpdk.org Cc: maxime.coquelin@redhat.com, zhihong.wang@intel.com Date: Fri, 9 Aug 2019 19:11:05 +0800 Message-Id: <20190809111106.32223-3-tiwei.bie@intel.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20190809111106.32223-1-tiwei.bie@intel.com> References: <20190809111106.32223-1-tiwei.bie@intel.com> Subject: [dpdk-stable] [PATCH 17.11 2/3] vhost: fix potential use-after-free for zero copy mbuf X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: patches for DPDK stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: stable-bounces@dpdk.org Sender: "stable" [ backported from upstream commit d767436ee5d26d1d417ae17d1a2a47879bf632a6 ] Don't free the zero copy mbufs before they have been consumed, otherwise there could be use-after-free. Fixes: b0a985d1f340 ("vhost: add dequeue zero copy") Signed-off-by: Tiwei Bie Reviewed-by: Maxime Coquelin --- lib/librte_vhost/vhost.h | 12 ++++++++++++ lib/librte_vhost/vhost_user.c | 3 +++ lib/librte_vhost/virtio_net.c | 12 ------------ 3 files changed, 15 insertions(+), 12 deletions(-) diff --git a/lib/librte_vhost/vhost.h b/lib/librte_vhost/vhost.h index c9e86a2c9..ccd6c015c 100644 --- a/lib/librte_vhost/vhost.h +++ b/lib/librte_vhost/vhost.h @@ -529,4 +529,16 @@ restore_mbuf(struct rte_mbuf *m) } } +static __rte_always_inline bool +mbuf_is_consumed(struct rte_mbuf *m) +{ + while (m) { + if (rte_mbuf_refcnt_read(m) > 1) + return false; + m = m->next; + } + + return true; +} + #endif /* _VHOST_NET_CDEV_H_ */ diff --git a/lib/librte_vhost/vhost_user.c b/lib/librte_vhost/vhost_user.c index 7c0d8c6e4..63b200127 100644 --- a/lib/librte_vhost/vhost_user.c +++ b/lib/librte_vhost/vhost_user.c @@ -888,6 +888,9 @@ free_zmbufs(struct vhost_virtqueue *vq) zmbuf != NULL; zmbuf = next) { next = TAILQ_NEXT(zmbuf, next); + while (!mbuf_is_consumed(zmbuf->mbuf)) + usleep(1000); + restore_mbuf(zmbuf->mbuf); rte_pktmbuf_free(zmbuf->mbuf); TAILQ_REMOVE(&vq->zmbuf_list, zmbuf, next); diff --git a/lib/librte_vhost/virtio_net.c b/lib/librte_vhost/virtio_net.c index e3d50c96b..71d3d9c5b 100644 --- a/lib/librte_vhost/virtio_net.c +++ b/lib/librte_vhost/virtio_net.c @@ -1454,18 +1454,6 @@ get_zmbuf(struct vhost_virtqueue *vq) return NULL; } -static __rte_always_inline bool -mbuf_is_consumed(struct rte_mbuf *m) -{ - while (m) { - if (rte_mbuf_refcnt_read(m) > 1) - return false; - m = m->next; - } - - return true; -} - uint16_t rte_vhost_dequeue_burst(int vid, uint16_t queue_id, struct rte_mempool *mbuf_pool, struct rte_mbuf **pkts, uint16_t count) -- 2.17.1