From mboxrd@z Thu Jan 1 00:00:00 1970
Return-Path: <dariusz.stojaczyk@intel.com>
Received: from mga18.intel.com (mga18.intel.com [134.134.136.126])
by dpdk.org (Postfix) with ESMTP id 4C90D4C99;
Thu, 25 Oct 2018 12:50:12 +0200 (CEST)
X-Amp-Result: SKIPPED(no attachment in message)
X-Amp-File-Uploaded: False
Received: from orsmga002.jf.intel.com ([10.7.209.21])
by orsmga106.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384;
25 Oct 2018 03:50:11 -0700
X-ExtLoop1: 1
X-IronPort-AV: E=Sophos;i="5.54,424,1534834800"; d="scan'208";a="103183462"
Received: from violet.igk.intel.com ([10.102.54.177])
by orsmga002.jf.intel.com with ESMTP; 25 Oct 2018 03:50:10 -0700
From: Darek Stojaczyk <dariusz.stojaczyk@intel.com>
To: dev@dpdk.org
Cc: Darek Stojaczyk <dariusz.stojaczyk@intel.com>, jianfeng.tan@intel.com,
anatoly.burakov@intel.com, stable@dpdk.org
Date: Thu, 25 Oct 2018 12:49:10 +0200
Message-Id: <20181025104911.137496-1-dariusz.stojaczyk@intel.com>
X-Mailer: git-send-email 2.17.1
Subject: [dpdk-stable] [PATCH] vfio: fix read-after-free on getting
container fd
X-BeenThere: stable@dpdk.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: patches for DPDK stable branches <stable.dpdk.org>
List-Unsubscribe: <https://mails.dpdk.org/options/stable>,
<mailto:stable-request@dpdk.org?subject=unsubscribe>
List-Archive: <http://mails.dpdk.org/archives/stable/>
List-Post: <mailto:stable@dpdk.org>
List-Help: <mailto:stable-request@dpdk.org?subject=help>
List-Subscribe: <https://mails.dpdk.org/listinfo/stable>,
<mailto:stable-request@dpdk.org?subject=subscribe>
X-List-Received-Date: Thu, 25 Oct 2018 10:50:13 -0000
We were reading some memory just after freeing it.
Fixes: 83a73c5fef66 ("vfio: use generic multi-process channel")
Cc: jianfeng.tan@intel.com
Cc: anatoly.burakov@intel.com
Cc: stable@dpdk.org
Signed-off-by: Darek Stojaczyk <dariusz.stojaczyk@intel.com>
---
lib/librte_eal/linuxapp/eal/eal_vfio.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/lib/librte_eal/linuxapp/eal/eal_vfio.c b/lib/librte_eal/linuxapp/eal/eal_vfio.c
index d7268e4ce..fc3c7b870 100644
--- a/lib/librte_eal/linuxapp/eal/eal_vfio.c
+++ b/lib/librte_eal/linuxapp/eal/eal_vfio.c
@@ -1034,8 +1034,9 @@ rte_vfio_get_container_fd(void)
mp_rep = &mp_reply.msgs[0];
p = (struct vfio_mp_param *)mp_rep->param;
if (p->result == SOCKET_OK && mp_rep->num_fds == 1) {
+ vfio_container_fd = mp_rep->fds[0];
free(mp_reply.msgs);
- return mp_rep->fds[0];
+ return vfio_container_fd;
}
free(mp_reply.msgs);
}
--
2.17.1