[PATCH v3 1/4] vhost: fix vq use after free on NUMA reallocation
Maxime Coquelin
maxime.coquelin at redhat.com
Tue Jul 26 09:55:05 CEST 2022
On 7/25/22 22:32, David Marchand wrote:
> translate_ring_addresses (via numa_realloc) may change a virtio device and
> virtio queue.
> The virtqueue object must be refreshed before accessing the lock.
>
> Fixes: 04c27cb673b9 ("vhost: fix unsafe vring addresses modifications")
> Cc: stable at dpdk.org
>
> Signed-off-by: David Marchand <david.marchand at redhat.com>
> ---
> lib/vhost/vhost_user.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/lib/vhost/vhost_user.c b/lib/vhost/vhost_user.c
> index 4ad28bac45..91d40e32fc 100644
> --- a/lib/vhost/vhost_user.c
> +++ b/lib/vhost/vhost_user.c
> @@ -2596,6 +2596,7 @@ vhost_user_iotlb_msg(struct virtio_net **pdev,
> if (is_vring_iotlb(dev, vq, imsg)) {
> rte_spinlock_lock(&vq->access_lock);
> *pdev = dev = translate_ring_addresses(dev, i);
> + vq = dev->virtqueue[i];
> rte_spinlock_unlock(&vq->access_lock);
> }
> }
Reviewed-by: Maxime Coquelin <maxime.coquelin at redhat.com>
Thanks,
Maxime
More information about the stable
mailing list