Hi Wenwu, > -----Original Message----- > From: Ma, WenwuX <[email protected]> > Sent: Friday, September 24, 2021 4:30 AM > To: [email protected] > Cc: [email protected]; Xia, Chenbo <[email protected]>; Hu, Jiayu > <[email protected]>; Yang, YvonneX <[email protected]>; Ma, WenwuX > <[email protected]> > Subject: [PATCH] examples/vhost: fix use-after-free on drain vhost > > When a vdev is removed in destroy_device function, > the corresponding vhost_txbuff[vdev->vid] will also > be free, but the vhost_txbuff[vdev->vid] may still
Free -> freed vhost_txbuff[vdev->vid] -> vhost TX buffer > be used in the drain_vhost function, which will cause > an error of heap-use-after-free. Therefore, before > accessing vhost_txbuff[vdev->vid], we need to check > whether the vdev has been removed, if so, let's skip > this vdev. This is a bug fix. Please add fix and cc-stable tag. Thanks, Chenbo > > Signed-off-by: Wenwu Ma <[email protected]> > --- > examples/vhost/main.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/examples/vhost/main.c b/examples/vhost/main.c > index d0bf1f31e3..1f6f7be8e3 100644 > --- a/examples/vhost/main.c > +++ b/examples/vhost/main.c > @@ -916,6 +916,9 @@ drain_vhost_table(void) > uint64_t cur_tsc; > > TAILQ_FOREACH(vdev, &vhost_dev_list, global_vdev_entry) { > + if (unlikely(vdev->remove == 1)) > + continue; > + > vhost_txq = vhost_txbuff[lcore_id * MAX_VHOST_DEVICE > + vdev->vid]; > > -- > 2.25.1
