diff mbox series

lib/rte_eal: fix heap-use-after-free bug

Message ID 20200421032957.19548-1-huwei013@chinasoftinc.com (mailing list archive)
State Accepted, archived
Delegated to: David Marchand
Headers
Series lib/rte_eal: fix heap-use-after-free bug |

Checks

Context Check Description
ci/checkpatch success coding style OK
ci/Intel-compilation success Compilation OK
ci/iol-intel-Performance success Performance Testing PASS
ci/iol-nxp-Performance success Performance Testing PASS
ci/iol-mellanox-Performance success Performance Testing PASS
ci/travis-robot warning Travis build: failed
ci/iol-testing fail Testing issues

Commit Message

Wei Hu (Xavier) April 21, 2020, 3:29 a.m. UTC 
  From: "Wei Hu (Xavier)" <xavier.huwei@huawei.com>

This patch fixes the heap-use-after-free bug which was found by ASAN
(Address-Sanitizer) in the vfio_get_default_container_fd function.

Fixes: 6bcb7c95fe14 ("vfio: share default container in multi-process")
Cc: stable@dpdk.org

Signed-off-by: Chengwen Feng <fengchengwen@huawei.com>
Signed-off-by: Wei Hu (Xavier) <xavier.huwei@huawei.com>
---
 lib/librte_eal/linux/eal_vfio.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

Comments

Anatoly Burakov April 21, 2020, 12:54 p.m. UTC | #1 
On 21-Apr-20 4:29 AM, Wei Hu (Xavier) wrote:
> From: "Wei Hu (Xavier)" <xavier.huwei@huawei.com>
> 
> This patch fixes the heap-use-after-free bug which was found by ASAN
> (Address-Sanitizer) in the vfio_get_default_container_fd function.
> 
> Fixes: 6bcb7c95fe14 ("vfio: share default container in multi-process")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Chengwen Feng <fengchengwen@huawei.com>
> Signed-off-by: Wei Hu (Xavier) <xavier.huwei@huawei.com>
> ---

Acked-by: Anatoly Burakov <anatoly.burakov@intel.com>
David Marchand April 21, 2020, 4:19 p.m. UTC | #2 
On Tue, Apr 21, 2020 at 2:54 PM Burakov, Anatoly
<anatoly.burakov@intel.com> wrote:
>
> On 21-Apr-20 4:29 AM, Wei Hu (Xavier) wrote:
> > From: "Wei Hu (Xavier)" <xavier.huwei@huawei.com>
> >
> > This patch fixes the heap-use-after-free bug which was found by ASAN
> > (Address-Sanitizer) in the vfio_get_default_container_fd function.
> >
> > Fixes: 6bcb7c95fe14 ("vfio: share default container in multi-process")
> > Cc: stable@dpdk.org
> >
> > Signed-off-by: Chengwen Feng <fengchengwen@huawei.com>
> > Signed-off-by: Wei Hu (Xavier) <xavier.huwei@huawei.com>
> > ---
>
> Acked-by: Anatoly Burakov <anatoly.burakov@intel.com>

Applied, thanks.
diff mbox series

Patch

diff --git a/lib/librte_eal/linux/eal_vfio.c b/lib/librte_eal/linux/eal_vfio.c
index 4502aefed..1470b58c6 100644
--- a/lib/librte_eal/linux/eal_vfio.c
+++ b/lib/librte_eal/linux/eal_vfio.c
@@ -1092,6 +1092,7 @@  vfio_get_default_container_fd(void)
 	struct rte_mp_reply mp_reply = {0};
 	struct timespec ts = {.tv_sec = 5, .tv_nsec = 0};
 	struct vfio_mp_param *p = (struct vfio_mp_param *)mp_req.param;
+	int container_fd;
 
 	if (default_vfio_cfg->vfio_enabled)
 		return default_vfio_cfg->vfio_container_fd;
@@ -1114,8 +1115,9 @@  vfio_get_default_container_fd(void)
 		mp_rep = &mp_reply.msgs[0];
 		p = (struct vfio_mp_param *)mp_rep->param;
 		if (p->result == SOCKET_OK && mp_rep->num_fds == 1) {
+			container_fd = mp_rep->fds[0];
 			free(mp_reply.msgs);
-			return mp_rep->fds[0];
+			return container_fd;
 		}
 	}