DPDK patches and discussions
 help / color / mirror / Atom feed
* [dpdk-dev] [PATCH] examples/vhost: fix use-after-free on drain vhost
@ 2021-09-23 20:29 Wenwu Ma
  2021-09-24  2:22 ` Xia, Chenbo
  2021-09-24 17:23 ` [dpdk-dev] [PATCH v2] " Wenwu Ma
  0 siblings, 2 replies; 5+ messages in thread
From: Wenwu Ma @ 2021-09-23 20:29 UTC (permalink / raw)
  To: dev; +Cc: maxime.coquelin, chenbo.xia, jiayu.hu, yvonnex.yang, Wenwu Ma

When a vdev is removed in destroy_device function,
the corresponding vhost_txbuff[vdev->vid] will also
be free, but the vhost_txbuff[vdev->vid] may still
be used in the drain_vhost function, which will cause
an error of heap-use-after-free. Therefore, before
accessing vhost_txbuff[vdev->vid], we need to check
whether the vdev has been removed, if so, let's skip
this vdev.

Signed-off-by: Wenwu Ma <wenwux.ma@intel.com>
---
 examples/vhost/main.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/examples/vhost/main.c b/examples/vhost/main.c
index d0bf1f31e3..1f6f7be8e3 100644
--- a/examples/vhost/main.c
+++ b/examples/vhost/main.c
@@ -916,6 +916,9 @@ drain_vhost_table(void)
 	uint64_t cur_tsc;
 
 	TAILQ_FOREACH(vdev, &vhost_dev_list, global_vdev_entry) {
+		if (unlikely(vdev->remove == 1))
+			continue;
+
 		vhost_txq = vhost_txbuff[lcore_id * MAX_VHOST_DEVICE
 						+ vdev->vid];
 
-- 
2.25.1


^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: [dpdk-dev] [PATCH] examples/vhost: fix use-after-free on drain vhost
  2021-09-23 20:29 [dpdk-dev] [PATCH] examples/vhost: fix use-after-free on drain vhost Wenwu Ma
@ 2021-09-24  2:22 ` Xia, Chenbo
  2021-09-24 17:23 ` [dpdk-dev] [PATCH v2] " Wenwu Ma
  1 sibling, 0 replies; 5+ messages in thread
From: Xia, Chenbo @ 2021-09-24  2:22 UTC (permalink / raw)
  To: Ma, WenwuX, dev; +Cc: maxime.coquelin, Hu, Jiayu, Yang, YvonneX

Hi Wenwu,

> -----Original Message-----
> From: Ma, WenwuX <wenwux.ma@intel.com>
> Sent: Friday, September 24, 2021 4:30 AM
> To: dev@dpdk.org
> Cc: maxime.coquelin@redhat.com; Xia, Chenbo <chenbo.xia@intel.com>; Hu, Jiayu
> <jiayu.hu@intel.com>; Yang, YvonneX <yvonnex.yang@intel.com>; Ma, WenwuX
> <wenwux.ma@intel.com>
> Subject: [PATCH] examples/vhost: fix use-after-free on drain vhost
> 
> When a vdev is removed in destroy_device function,
> the corresponding vhost_txbuff[vdev->vid] will also
> be free, but the vhost_txbuff[vdev->vid] may still

Free -> freed

vhost_txbuff[vdev->vid] -> vhost TX buffer

> be used in the drain_vhost function, which will cause
> an error of heap-use-after-free. Therefore, before
> accessing vhost_txbuff[vdev->vid], we need to check
> whether the vdev has been removed, if so, let's skip
> this vdev.

This is a bug fix. Please add fix and cc-stable tag.

Thanks,
Chenbo

> 
> Signed-off-by: Wenwu Ma <wenwux.ma@intel.com>
> ---
>  examples/vhost/main.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/examples/vhost/main.c b/examples/vhost/main.c
> index d0bf1f31e3..1f6f7be8e3 100644
> --- a/examples/vhost/main.c
> +++ b/examples/vhost/main.c
> @@ -916,6 +916,9 @@ drain_vhost_table(void)
>  	uint64_t cur_tsc;
> 
>  	TAILQ_FOREACH(vdev, &vhost_dev_list, global_vdev_entry) {
> +		if (unlikely(vdev->remove == 1))
> +			continue;
> +
>  		vhost_txq = vhost_txbuff[lcore_id * MAX_VHOST_DEVICE
>  						+ vdev->vid];
> 
> --
> 2.25.1


^ permalink raw reply	[flat|nested] 5+ messages in thread

* [dpdk-dev] [PATCH v2] examples/vhost: fix use-after-free on drain vhost
  2021-09-23 20:29 [dpdk-dev] [PATCH] examples/vhost: fix use-after-free on drain vhost Wenwu Ma
  2021-09-24  2:22 ` Xia, Chenbo
@ 2021-09-24 17:23 ` Wenwu Ma
  2021-09-29  7:23   ` Xia, Chenbo
  2021-10-21 12:28   ` Maxime Coquelin
  1 sibling, 2 replies; 5+ messages in thread
From: Wenwu Ma @ 2021-09-24 17:23 UTC (permalink / raw)
  To: dev
  Cc: maxime.coquelin, chenbo.xia, cheng1.jiang, jiayu.hu,
	yvonnex.yang, Wenwu Ma, stable

When a vdev is removed in destroy_device function,
the corresponding vhost TX buffer will also be freed,
but the vhost TX buffer may still be used in the
drain_vhost function, which will cause an error of
heap-use-after-free. Therefore, before accessing
vhost TX buffer, we need to check whether the vdev
has been removed, if so, let's skip this vdev.

Fixes: a68ba8e0a6b6 ("examples/vhost: refactor vhost data path")
Cc: stable@dpdk.org

Signed-off-by: Wenwu Ma <wenwux.ma@intel.com>
---
 examples/vhost/main.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/examples/vhost/main.c b/examples/vhost/main.c
index d0bf1f31e3..1f6f7be8e3 100644
--- a/examples/vhost/main.c
+++ b/examples/vhost/main.c
@@ -916,6 +916,9 @@ drain_vhost_table(void)
 	uint64_t cur_tsc;
 
 	TAILQ_FOREACH(vdev, &vhost_dev_list, global_vdev_entry) {
+		if (unlikely(vdev->remove == 1))
+			continue;
+
 		vhost_txq = vhost_txbuff[lcore_id * MAX_VHOST_DEVICE
 						+ vdev->vid];
 
-- 
2.25.1


^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: [dpdk-dev] [PATCH v2] examples/vhost: fix use-after-free on drain vhost
  2021-09-24 17:23 ` [dpdk-dev] [PATCH v2] " Wenwu Ma
@ 2021-09-29  7:23   ` Xia, Chenbo
  2021-10-21 12:28   ` Maxime Coquelin
  1 sibling, 0 replies; 5+ messages in thread
From: Xia, Chenbo @ 2021-09-29  7:23 UTC (permalink / raw)
  To: Ma, WenwuX, dev
  Cc: maxime.coquelin, Jiang, Cheng1, Hu, Jiayu, Yang, YvonneX, stable

> -----Original Message-----
> From: Ma, WenwuX <wenwux.ma@intel.com>
> Sent: Saturday, September 25, 2021 1:23 AM
> To: dev@dpdk.org
> Cc: maxime.coquelin@redhat.com; Xia, Chenbo <chenbo.xia@intel.com>; Jiang,
> Cheng1 <cheng1.jiang@intel.com>; Hu, Jiayu <jiayu.hu@intel.com>; Yang, YvonneX
> <yvonnex.yang@intel.com>; Ma, WenwuX <wenwux.ma@intel.com>; stable@dpdk.org
> Subject: [PATCH v2] examples/vhost: fix use-after-free on drain vhost
> 
> When a vdev is removed in destroy_device function,
> the corresponding vhost TX buffer will also be freed,
> but the vhost TX buffer may still be used in the
> drain_vhost function, which will cause an error of
> heap-use-after-free. Therefore, before accessing
> vhost TX buffer, we need to check whether the vdev
> has been removed, if so, let's skip this vdev.
> 
> Fixes: a68ba8e0a6b6 ("examples/vhost: refactor vhost data path")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Wenwu Ma <wenwux.ma@intel.com>
> ---

Reviewed-by: Chenbo Xia <chenbo.xia@intel.com>

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: [dpdk-dev] [PATCH v2] examples/vhost: fix use-after-free on drain vhost
  2021-09-24 17:23 ` [dpdk-dev] [PATCH v2] " Wenwu Ma
  2021-09-29  7:23   ` Xia, Chenbo
@ 2021-10-21 12:28   ` Maxime Coquelin
  1 sibling, 0 replies; 5+ messages in thread
From: Maxime Coquelin @ 2021-10-21 12:28 UTC (permalink / raw)
  To: Wenwu Ma, dev; +Cc: chenbo.xia, cheng1.jiang, jiayu.hu, yvonnex.yang, stable



On 9/24/21 19:23, Wenwu Ma wrote:
> When a vdev is removed in destroy_device function,
> the corresponding vhost TX buffer will also be freed,
> but the vhost TX buffer may still be used in the
> drain_vhost function, which will cause an error of
> heap-use-after-free. Therefore, before accessing
> vhost TX buffer, we need to check whether the vdev
> has been removed, if so, let's skip this vdev.
> 
> Fixes: a68ba8e0a6b6 ("examples/vhost: refactor vhost data path")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Wenwu Ma <wenwux.ma@intel.com>
> ---
>   examples/vhost/main.c | 3 +++
>   1 file changed, 3 insertions(+)
> 
> diff --git a/examples/vhost/main.c b/examples/vhost/main.c
> index d0bf1f31e3..1f6f7be8e3 100644
> --- a/examples/vhost/main.c
> +++ b/examples/vhost/main.c
> @@ -916,6 +916,9 @@ drain_vhost_table(void)
>   	uint64_t cur_tsc;
>   
>   	TAILQ_FOREACH(vdev, &vhost_dev_list, global_vdev_entry) {
> +		if (unlikely(vdev->remove == 1))
> +			continue;
> +
>   		vhost_txq = vhost_txbuff[lcore_id * MAX_VHOST_DEVICE
>   						+ vdev->vid];
>   
> 

Applied to dpdk-next-virtio/main.

Thanks,
Maxime


^ permalink raw reply	[flat|nested] 5+ messages in thread

end of thread, other threads:[~2021-10-21 12:28 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-09-23 20:29 [dpdk-dev] [PATCH] examples/vhost: fix use-after-free on drain vhost Wenwu Ma
2021-09-24  2:22 ` Xia, Chenbo
2021-09-24 17:23 ` [dpdk-dev] [PATCH v2] " Wenwu Ma
2021-09-29  7:23   ` Xia, Chenbo
2021-10-21 12:28   ` Maxime Coquelin

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).