DPDK patches and discussions
 help / color / mirror / Atom feed
* [dpdk-dev] [PATCH] lib/rte_eal: fix heap-use-after-free bug
@ 2020-04-21  3:29 Wei Hu (Xavier)
  2020-04-21 12:54 ` Burakov, Anatoly
  0 siblings, 1 reply; 3+ messages in thread
From: Wei Hu (Xavier) @ 2020-04-21  3:29 UTC (permalink / raw)
  To: dev

From: "Wei Hu (Xavier)" <xavier.huwei@huawei.com>

This patch fixes the heap-use-after-free bug which was found by ASAN
(Address-Sanitizer) in the vfio_get_default_container_fd function.

Fixes: 6bcb7c95fe14 ("vfio: share default container in multi-process")
Cc: stable@dpdk.org

Signed-off-by: Chengwen Feng <fengchengwen@huawei.com>
Signed-off-by: Wei Hu (Xavier) <xavier.huwei@huawei.com>
---
 lib/librte_eal/linux/eal_vfio.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/librte_eal/linux/eal_vfio.c b/lib/librte_eal/linux/eal_vfio.c
index 4502aefed..1470b58c6 100644
--- a/lib/librte_eal/linux/eal_vfio.c
+++ b/lib/librte_eal/linux/eal_vfio.c
@@ -1092,6 +1092,7 @@ vfio_get_default_container_fd(void)
 	struct rte_mp_reply mp_reply = {0};
 	struct timespec ts = {.tv_sec = 5, .tv_nsec = 0};
 	struct vfio_mp_param *p = (struct vfio_mp_param *)mp_req.param;
+	int container_fd;
 
 	if (default_vfio_cfg->vfio_enabled)
 		return default_vfio_cfg->vfio_container_fd;
@@ -1114,8 +1115,9 @@ vfio_get_default_container_fd(void)
 		mp_rep = &mp_reply.msgs[0];
 		p = (struct vfio_mp_param *)mp_rep->param;
 		if (p->result == SOCKET_OK && mp_rep->num_fds == 1) {
+			container_fd = mp_rep->fds[0];
 			free(mp_reply.msgs);
-			return mp_rep->fds[0];
+			return container_fd;
 		}
 	}
 
-- 
2.23.0


^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [dpdk-dev] [PATCH] lib/rte_eal: fix heap-use-after-free bug
  2020-04-21  3:29 [dpdk-dev] [PATCH] lib/rte_eal: fix heap-use-after-free bug Wei Hu (Xavier)
@ 2020-04-21 12:54 ` Burakov, Anatoly
  2020-04-21 16:19   ` David Marchand
  0 siblings, 1 reply; 3+ messages in thread
From: Burakov, Anatoly @ 2020-04-21 12:54 UTC (permalink / raw)
  To: Wei Hu (Xavier), dev

On 21-Apr-20 4:29 AM, Wei Hu (Xavier) wrote:
> From: "Wei Hu (Xavier)" <xavier.huwei@huawei.com>
> 
> This patch fixes the heap-use-after-free bug which was found by ASAN
> (Address-Sanitizer) in the vfio_get_default_container_fd function.
> 
> Fixes: 6bcb7c95fe14 ("vfio: share default container in multi-process")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Chengwen Feng <fengchengwen@huawei.com>
> Signed-off-by: Wei Hu (Xavier) <xavier.huwei@huawei.com>
> ---

Acked-by: Anatoly Burakov <anatoly.burakov@intel.com>

-- 
Thanks,
Anatoly

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [dpdk-dev] [PATCH] lib/rte_eal: fix heap-use-after-free bug
  2020-04-21 12:54 ` Burakov, Anatoly
@ 2020-04-21 16:19   ` David Marchand
  0 siblings, 0 replies; 3+ messages in thread
From: David Marchand @ 2020-04-21 16:19 UTC (permalink / raw)
  To: Wei Hu (Xavier); +Cc: dev, Burakov, Anatoly

On Tue, Apr 21, 2020 at 2:54 PM Burakov, Anatoly
<anatoly.burakov@intel.com> wrote:
>
> On 21-Apr-20 4:29 AM, Wei Hu (Xavier) wrote:
> > From: "Wei Hu (Xavier)" <xavier.huwei@huawei.com>
> >
> > This patch fixes the heap-use-after-free bug which was found by ASAN
> > (Address-Sanitizer) in the vfio_get_default_container_fd function.
> >
> > Fixes: 6bcb7c95fe14 ("vfio: share default container in multi-process")
> > Cc: stable@dpdk.org
> >
> > Signed-off-by: Chengwen Feng <fengchengwen@huawei.com>
> > Signed-off-by: Wei Hu (Xavier) <xavier.huwei@huawei.com>
> > ---
>
> Acked-by: Anatoly Burakov <anatoly.burakov@intel.com>

Applied, thanks.


-- 
David Marchand


^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2020-04-21 16:19 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-04-21  3:29 [dpdk-dev] [PATCH] lib/rte_eal: fix heap-use-after-free bug Wei Hu (Xavier)
2020-04-21 12:54 ` Burakov, Anatoly
2020-04-21 16:19   ` David Marchand

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).