* [PATCH] vhost: fix null pointer dereference
@ 2022-03-28 2:07 Jiayu Hu
2022-03-28 7:04 ` David Marchand
0 siblings, 1 reply; 7+ messages in thread
From: Jiayu Hu @ 2022-03-28 2:07 UTC (permalink / raw)
To: dev; +Cc: maxime.coquelin, Jiayu Hu, stable
NULL check for vq->async must be protected by lock. Otherwise, it is
possible that the data plane thread dereferences vq->async with NULL
value, since the control plane thread is freeing vq->async.
Fixes: ee8024b3d4ad (vhost: move async data in dedicated structure)
Cc: stable@dpdk.org
Signed-off-by: Jiayu Hu <jiayu.hu@intel.com>
---
lib/vhost/vhost.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/lib/vhost/vhost.c b/lib/vhost/vhost.c
index bc88148347..7f60c2824f 100644
--- a/lib/vhost/vhost.c
+++ b/lib/vhost/vhost.c
@@ -1887,9 +1887,6 @@ rte_vhost_async_get_inflight(int vid, uint16_t queue_id)
if (vq == NULL)
return ret;
- if (!vq->async)
- return ret;
-
if (!rte_spinlock_trylock(&vq->access_lock)) {
VHOST_LOG_CONFIG(DEBUG,
"(%s) failed to check in-flight packets. virtqueue busy.\n",
@@ -1897,6 +1894,9 @@ rte_vhost_async_get_inflight(int vid, uint16_t queue_id)
return ret;
}
+ if (!vq->async)
+ return ret;
+
ret = vq->async->pkts_inflight_n;
rte_spinlock_unlock(&vq->access_lock);
--
2.25.1
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH] vhost: fix null pointer dereference
2022-03-28 2:07 [PATCH] vhost: fix null pointer dereference Jiayu Hu
@ 2022-03-28 7:04 ` David Marchand
2022-06-01 7:58 ` Maxime Coquelin
0 siblings, 1 reply; 7+ messages in thread
From: David Marchand @ 2022-03-28 7:04 UTC (permalink / raw)
To: Jiayu Hu; +Cc: dev, Maxime Coquelin, dpdk stable
On Mon, Mar 28, 2022 at 4:08 AM Jiayu Hu <jiayu.hu@intel.com> wrote:
>
> NULL check for vq->async must be protected by lock. Otherwise, it is
> possible that the data plane thread dereferences vq->async with NULL
> value, since the control plane thread is freeing vq->async.
>
> Fixes: ee8024b3d4ad (vhost: move async data in dedicated structure)
> Cc: stable@dpdk.org
>
> Signed-off-by: Jiayu Hu <jiayu.hu@intel.com>
> ---
> lib/vhost/vhost.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/lib/vhost/vhost.c b/lib/vhost/vhost.c
> index bc88148347..7f60c2824f 100644
> --- a/lib/vhost/vhost.c
> +++ b/lib/vhost/vhost.c
> @@ -1887,9 +1887,6 @@ rte_vhost_async_get_inflight(int vid, uint16_t queue_id)
> if (vq == NULL)
> return ret;
>
> - if (!vq->async)
> - return ret;
> -
> if (!rte_spinlock_trylock(&vq->access_lock)) {
> VHOST_LOG_CONFIG(DEBUG,
> "(%s) failed to check in-flight packets. virtqueue busy.\n",
> @@ -1897,6 +1894,9 @@ rte_vhost_async_get_inflight(int vid, uint16_t queue_id)
> return ret;
> }
>
> + if (!vq->async)
> + return ret;
Lock is still taken at this point.
FYI, I'll post a series to instrument locks in vhost, soon.
> +
> ret = vq->async->pkts_inflight_n;
> rte_spinlock_unlock(&vq->access_lock);
>
--
David Marchand
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH] vhost: fix null pointer dereference
2022-03-28 7:04 ` David Marchand
@ 2022-06-01 7:58 ` Maxime Coquelin
2022-06-09 3:52 ` Hu, Jiayu
0 siblings, 1 reply; 7+ messages in thread
From: Maxime Coquelin @ 2022-06-01 7:58 UTC (permalink / raw)
To: Jiayu Hu; +Cc: dev, dpdk stable, David Marchand
HI Jiayu,
On 3/28/22 09:04, David Marchand wrote:
> On Mon, Mar 28, 2022 at 4:08 AM Jiayu Hu <jiayu.hu@intel.com> wrote:
>>
>> NULL check for vq->async must be protected by lock. Otherwise, it is
>> possible that the data plane thread dereferences vq->async with NULL
>> value, since the control plane thread is freeing vq->async.
>>
>> Fixes: ee8024b3d4ad (vhost: move async data in dedicated structure)
>> Cc: stable@dpdk.org
>>
>> Signed-off-by: Jiayu Hu <jiayu.hu@intel.com>
>> ---
>> lib/vhost/vhost.c | 6 +++---
>> 1 file changed, 3 insertions(+), 3 deletions(-)
>>
>> diff --git a/lib/vhost/vhost.c b/lib/vhost/vhost.c
>> index bc88148347..7f60c2824f 100644
>> --- a/lib/vhost/vhost.c
>> +++ b/lib/vhost/vhost.c
>> @@ -1887,9 +1887,6 @@ rte_vhost_async_get_inflight(int vid, uint16_t queue_id)
>> if (vq == NULL)
>> return ret;
>>
>> - if (!vq->async)
>> - return ret;
>> -
>> if (!rte_spinlock_trylock(&vq->access_lock)) {
>> VHOST_LOG_CONFIG(DEBUG,
>> "(%s) failed to check in-flight packets. virtqueue busy.\n",
>> @@ -1897,6 +1894,9 @@ rte_vhost_async_get_inflight(int vid, uint16_t queue_id)
>> return ret;
>> }
>>
>> + if (!vq->async)
>> + return ret;
>
> Lock is still taken at this point.
>
> FYI, I'll post a series to instrument locks in vhost, soon.
Could you please send a v2 which does not return with the lock taken?
>> +
>> ret = vq->async->pkts_inflight_n;
>> rte_spinlock_unlock(&vq->access_lock);
>>
>
>
Thanks,
Maxime
^ permalink raw reply [flat|nested] 7+ messages in thread* RE: [PATCH] vhost: fix null pointer dereference
2022-06-01 7:58 ` Maxime Coquelin
@ 2022-06-09 3:52 ` Hu, Jiayu
0 siblings, 0 replies; 7+ messages in thread
From: Hu, Jiayu @ 2022-06-09 3:52 UTC (permalink / raw)
To: Maxime Coquelin; +Cc: dev, dpdk stable, David Marchand
Hi Maxime,
This issue has fixed in https://patches.dpdk.org/project/dpdk/patch/20220411110013.18624-4-david.marchand@redhat.com/.
Thanks,
Jiayu
> -----Original Message-----
> From: Maxime Coquelin <maxime.coquelin@redhat.com>
> Sent: Wednesday, June 1, 2022 3:58 PM
> To: Hu, Jiayu <jiayu.hu@intel.com>
> Cc: dev <dev@dpdk.org>; dpdk stable <stable@dpdk.org>; David Marchand
> <david.marchand@redhat.com>
> Subject: Re: [PATCH] vhost: fix null pointer dereference
>
> HI Jiayu,
>
> On 3/28/22 09:04, David Marchand wrote:
> > On Mon, Mar 28, 2022 at 4:08 AM Jiayu Hu <jiayu.hu@intel.com> wrote:
> >>
> >> NULL check for vq->async must be protected by lock. Otherwise, it is
> >> possible that the data plane thread dereferences vq->async with NULL
> >> value, since the control plane thread is freeing vq->async.
> >>
> >> Fixes: ee8024b3d4ad (vhost: move async data in dedicated structure)
> >> Cc: stable@dpdk.org
> >>
> >> Signed-off-by: Jiayu Hu <jiayu.hu@intel.com>
> >> ---
> >> lib/vhost/vhost.c | 6 +++---
> >> 1 file changed, 3 insertions(+), 3 deletions(-)
> >>
> >> diff --git a/lib/vhost/vhost.c b/lib/vhost/vhost.c index
> >> bc88148347..7f60c2824f 100644
> >> --- a/lib/vhost/vhost.c
> >> +++ b/lib/vhost/vhost.c
> >> @@ -1887,9 +1887,6 @@ rte_vhost_async_get_inflight(int vid, uint16_t
> queue_id)
> >> if (vq == NULL)
> >> return ret;
> >>
> >> - if (!vq->async)
> >> - return ret;
> >> -
> >> if (!rte_spinlock_trylock(&vq->access_lock)) {
> >> VHOST_LOG_CONFIG(DEBUG,
> >> "(%s) failed to check in-flight packets.
> >> virtqueue busy.\n", @@ -1897,6 +1894,9 @@
> rte_vhost_async_get_inflight(int vid, uint16_t queue_id)
> >> return ret;
> >> }
> >>
> >> + if (!vq->async)
> >> + return ret;
> >
> > Lock is still taken at this point.
> >
> > FYI, I'll post a series to instrument locks in vhost, soon.
>
> Could you please send a v2 which does not return with the lock taken?
>
> >> +
> >> ret = vq->async->pkts_inflight_n;
> >> rte_spinlock_unlock(&vq->access_lock);
> >>
> >
> >
>
> Thanks,
> Maxime
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH] vhost: fix null pointer dereference
@ 2022-01-29 19:07 Weiguo Li
2022-02-03 13:49 ` Maxime Coquelin
2022-02-10 21:23 ` Maxime Coquelin
0 siblings, 2 replies; 7+ messages in thread
From: Weiguo Li @ 2022-01-29 19:07 UTC (permalink / raw)
To: chenbo.xia; +Cc: maxime.coquelin, dev
Fixes: 155ee3542fb1 ("vhost: improve vhost-user layer logs")
Signed-off-by: Weiguo Li <liwg06@foxmail.com>
---
lib/vhost/vhost_user.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/vhost/vhost_user.c b/lib/vhost/vhost_user.c
index e8297a09eb..d032998488 100644
--- a/lib/vhost/vhost_user.c
+++ b/lib/vhost/vhost_user.c
@@ -671,7 +671,7 @@ numa_realloc(struct virtio_net *dev, int index)
dev = rte_realloc_socket(old_dev, sizeof(*dev), 0, node);
if (!dev) {
VHOST_LOG_CONFIG(ERR, "(%s) failed to realloc dev on node %d\n",
- dev->ifname, node);
+ old_dev->ifname, node);
return old_dev;
}
--
2.25.1
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH] vhost: fix null pointer dereference
2022-01-29 19:07 Weiguo Li
@ 2022-02-03 13:49 ` Maxime Coquelin
2022-02-10 21:23 ` Maxime Coquelin
1 sibling, 0 replies; 7+ messages in thread
From: Maxime Coquelin @ 2022-02-03 13:49 UTC (permalink / raw)
To: Weiguo Li, chenbo.xia; +Cc: dev
On 1/29/22 20:07, Weiguo Li wrote:
> Fixes: 155ee3542fb1 ("vhost: improve vhost-user layer logs")
>
> Signed-off-by: Weiguo Li <liwg06@foxmail.com>
> ---
> lib/vhost/vhost_user.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/lib/vhost/vhost_user.c b/lib/vhost/vhost_user.c
> index e8297a09eb..d032998488 100644
> --- a/lib/vhost/vhost_user.c
> +++ b/lib/vhost/vhost_user.c
> @@ -671,7 +671,7 @@ numa_realloc(struct virtio_net *dev, int index)
> dev = rte_realloc_socket(old_dev, sizeof(*dev), 0, node);
> if (!dev) {
> VHOST_LOG_CONFIG(ERR, "(%s) failed to realloc dev on node %d\n",
> - dev->ifname, node);
> + old_dev->ifname, node);
> return old_dev;
> }
>
Thanks for the fix.
Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>
Thanks,
Maxime
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH] vhost: fix null pointer dereference
2022-01-29 19:07 Weiguo Li
2022-02-03 13:49 ` Maxime Coquelin
@ 2022-02-10 21:23 ` Maxime Coquelin
1 sibling, 0 replies; 7+ messages in thread
From: Maxime Coquelin @ 2022-02-10 21:23 UTC (permalink / raw)
To: Weiguo Li, chenbo.xia; +Cc: dev
On 1/29/22 20:07, Weiguo Li wrote:
> Fixes: 155ee3542fb1 ("vhost: improve vhost-user layer logs")
>
> Signed-off-by: Weiguo Li <liwg06@foxmail.com>
> ---
> lib/vhost/vhost_user.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/lib/vhost/vhost_user.c b/lib/vhost/vhost_user.c
> index e8297a09eb..d032998488 100644
> --- a/lib/vhost/vhost_user.c
> +++ b/lib/vhost/vhost_user.c
> @@ -671,7 +671,7 @@ numa_realloc(struct virtio_net *dev, int index)
> dev = rte_realloc_socket(old_dev, sizeof(*dev), 0, node);
> if (!dev) {
> VHOST_LOG_CONFIG(ERR, "(%s) failed to realloc dev on node %d\n",
> - dev->ifname, node);
> + old_dev->ifname, node);
> return old_dev;
> }
>
Applied to dpdk-next-virtio/main.
Thanks,
Maxime
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2022-06-09 3:52 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-03-28 2:07 [PATCH] vhost: fix null pointer dereference Jiayu Hu
2022-03-28 7:04 ` David Marchand
2022-06-01 7:58 ` Maxime Coquelin
2022-06-09 3:52 ` Hu, Jiayu
-- strict thread matches above, loose matches on Subject: below --
2022-01-29 19:07 Weiguo Li
2022-02-03 13:49 ` Maxime Coquelin
2022-02-10 21:23 ` Maxime Coquelin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).