[dpdk-dev] [PATCH] lib/rte_eal: fix heap-use-after-free bug

[dpdk-dev] [PATCH] lib/rte_eal: fix heap-use-after-free bug

[Wei Hu (Xavier)]

From: "Wei Hu (Xavier)" <xavier.huwei@huawei.com>

This patch fixes the heap-use-after-free bug which was found by ASAN
(Address-Sanitizer) in the vfio_get_default_container_fd function.

Fixes: 6bcb7c95fe14 ("vfio: share default container in multi-process")
Cc: stable@dpdk.org

Signed-off-by: Chengwen Feng <fengchengwen@huawei.com>
Signed-off-by: Wei Hu (Xavier) <xavier.huwei@huawei.com>
---
 lib/librte_eal/linux/eal_vfio.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/librte_eal/linux/eal_vfio.c b/lib/librte_eal/linux/eal_vfio.c
index 4502aefed..1470b58c6 100644
--- a/lib/librte_eal/linux/eal_vfio.c
+++ b/lib/librte_eal/linux/eal_vfio.c
@@ -1092,6 +1092,7 @@ vfio_get_default_container_fd(void)
 	struct rte_mp_reply mp_reply = {0};
 	struct timespec ts = {.tv_sec = 5, .tv_nsec = 0};
 	struct vfio_mp_param *p = (struct vfio_mp_param *)mp_req.param;
+	int container_fd;
 
 	if (default_vfio_cfg->vfio_enabled)
 		return default_vfio_cfg->vfio_container_fd;
@@ -1114,8 +1115,9 @@ vfio_get_default_container_fd(void)
 		mp_rep = &mp_reply.msgs[0];
 		p = (struct vfio_mp_param *)mp_rep->param;
 		if (p->result == SOCKET_OK && mp_rep->num_fds == 1) {
+			container_fd = mp_rep->fds[0];
 			free(mp_reply.msgs);
-			return mp_rep->fds[0];
+			return container_fd;
 		}
 	}
 
-- 
2.23.0

Re: [dpdk-dev] [PATCH] lib/rte_eal: fix heap-use-after-free bug

[Burakov, Anatoly]

On 21-Apr-20 4:29 AM, Wei Hu (Xavier) wrote:
> From: "Wei Hu (Xavier)" <xavier.huwei@huawei.com>
> 
> This patch fixes the heap-use-after-free bug which was found by ASAN
> (Address-Sanitizer) in the vfio_get_default_container_fd function.
> 
> Fixes: 6bcb7c95fe14 ("vfio: share default container in multi-process")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Chengwen Feng <fengchengwen@huawei.com>
> Signed-off-by: Wei Hu (Xavier) <xavier.huwei@huawei.com>
> ---

Acked-by: Anatoly Burakov <anatoly.burakov@intel.com>

-- 
Thanks,
Anatoly

Re: [dpdk-dev] [PATCH] lib/rte_eal: fix heap-use-after-free bug

[David Marchand]

On Tue, Apr 21, 2020 at 2:54 PM Burakov, Anatoly
<anatoly.burakov@intel.com> wrote:
>
> On 21-Apr-20 4:29 AM, Wei Hu (Xavier) wrote:
> > From: "Wei Hu (Xavier)" <xavier.huwei@huawei.com>
> >
> > This patch fixes the heap-use-after-free bug which was found by ASAN
> > (Address-Sanitizer) in the vfio_get_default_container_fd function.
> >
> > Fixes: 6bcb7c95fe14 ("vfio: share default container in multi-process")
> > Cc: stable@dpdk.org
> >
> > Signed-off-by: Chengwen Feng <fengchengwen@huawei.com>
> > Signed-off-by: Wei Hu (Xavier) <xavier.huwei@huawei.com>
> > ---
>
> Acked-by: Anatoly Burakov <anatoly.burakov@intel.com>

Applied, thanks.


-- 
David Marchand