* Re: [dpdk-stable] [PATCH v2] examples/vhost: fix use-after-free on drain vhost
2021-09-24 17:23 ` [dpdk-stable] [PATCH v2] examples/vhost: fix use-after-free on drain vhost Wenwu Ma
@ 2021-09-29 7:23 ` Xia, Chenbo
2021-10-21 12:28 ` Maxime Coquelin
1 sibling, 0 replies; 3+ messages in thread
From: Xia, Chenbo @ 2021-09-29 7:23 UTC (permalink / raw)
To: Ma, WenwuX, dev
Cc: maxime.coquelin, Jiang, Cheng1, Hu, Jiayu, Yang, YvonneX, stable
> -----Original Message-----
> From: Ma, WenwuX <wenwux.ma@intel.com>
> Sent: Saturday, September 25, 2021 1:23 AM
> To: dev@dpdk.org
> Cc: maxime.coquelin@redhat.com; Xia, Chenbo <chenbo.xia@intel.com>; Jiang,
> Cheng1 <cheng1.jiang@intel.com>; Hu, Jiayu <jiayu.hu@intel.com>; Yang, YvonneX
> <yvonnex.yang@intel.com>; Ma, WenwuX <wenwux.ma@intel.com>; stable@dpdk.org
> Subject: [PATCH v2] examples/vhost: fix use-after-free on drain vhost
>
> When a vdev is removed in destroy_device function,
> the corresponding vhost TX buffer will also be freed,
> but the vhost TX buffer may still be used in the
> drain_vhost function, which will cause an error of
> heap-use-after-free. Therefore, before accessing
> vhost TX buffer, we need to check whether the vdev
> has been removed, if so, let's skip this vdev.
>
> Fixes: a68ba8e0a6b6 ("examples/vhost: refactor vhost data path")
> Cc: stable@dpdk.org
>
> Signed-off-by: Wenwu Ma <wenwux.ma@intel.com>
> ---
Reviewed-by: Chenbo Xia <chenbo.xia@intel.com>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [dpdk-stable] [PATCH v2] examples/vhost: fix use-after-free on drain vhost
2021-09-24 17:23 ` [dpdk-stable] [PATCH v2] examples/vhost: fix use-after-free on drain vhost Wenwu Ma
2021-09-29 7:23 ` Xia, Chenbo
@ 2021-10-21 12:28 ` Maxime Coquelin
1 sibling, 0 replies; 3+ messages in thread
From: Maxime Coquelin @ 2021-10-21 12:28 UTC (permalink / raw)
To: Wenwu Ma, dev; +Cc: chenbo.xia, cheng1.jiang, jiayu.hu, yvonnex.yang, stable
On 9/24/21 19:23, Wenwu Ma wrote:
> When a vdev is removed in destroy_device function,
> the corresponding vhost TX buffer will also be freed,
> but the vhost TX buffer may still be used in the
> drain_vhost function, which will cause an error of
> heap-use-after-free. Therefore, before accessing
> vhost TX buffer, we need to check whether the vdev
> has been removed, if so, let's skip this vdev.
>
> Fixes: a68ba8e0a6b6 ("examples/vhost: refactor vhost data path")
> Cc: stable@dpdk.org
>
> Signed-off-by: Wenwu Ma <wenwux.ma@intel.com>
> ---
> examples/vhost/main.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/examples/vhost/main.c b/examples/vhost/main.c
> index d0bf1f31e3..1f6f7be8e3 100644
> --- a/examples/vhost/main.c
> +++ b/examples/vhost/main.c
> @@ -916,6 +916,9 @@ drain_vhost_table(void)
> uint64_t cur_tsc;
>
> TAILQ_FOREACH(vdev, &vhost_dev_list, global_vdev_entry) {
> + if (unlikely(vdev->remove == 1))
> + continue;
> +
> vhost_txq = vhost_txbuff[lcore_id * MAX_VHOST_DEVICE
> + vdev->vid];
>
>
Applied to dpdk-next-virtio/main.
Thanks,
Maxime
^ permalink raw reply [flat|nested] 3+ messages in thread