[dpdk-stable] [PATCH v2] examples/vhost: fix use-after-free on drain vhost

[Maxime Coquelin]

On 9/24/21 19:23, Wenwu Ma wrote:
> When a vdev is removed in destroy_device function,
> the corresponding vhost TX buffer will also be freed,
> but the vhost TX buffer may still be used in the
> drain_vhost function, which will cause an error of
> heap-use-after-free. Therefore, before accessing
> vhost TX buffer, we need to check whether the vdev
> has been removed, if so, let's skip this vdev.
> 
> Fixes: a68ba8e0a6b6 ("examples/vhost: refactor vhost data path")
> Cc: stable at dpdk.org
> 
> Signed-off-by: Wenwu Ma <wenwux.ma at intel.com>
> ---
>   examples/vhost/main.c | 3 +++
>   1 file changed, 3 insertions(+)
> 
> diff --git a/examples/vhost/main.c b/examples/vhost/main.c
> index d0bf1f31e3..1f6f7be8e3 100644
> --- a/examples/vhost/main.c
> +++ b/examples/vhost/main.c
> @@ -916,6 +916,9 @@ drain_vhost_table(void)
>   	uint64_t cur_tsc;
>   
>   	TAILQ_FOREACH(vdev, &vhost_dev_list, global_vdev_entry) {
> +		if (unlikely(vdev->remove == 1))
> +			continue;
> +
>   		vhost_txq = vhost_txbuff[lcore_id * MAX_VHOST_DEVICE
>   						+ vdev->vid];
>   
> 

Applied to dpdk-next-virtio/main.

Thanks,
Maxime