On Mon, Jul 14, 2025 at 1:14 PM Stefano Garzarella <sgarz...@redhat.com> wrote:
>
> From: Stefano Garzarella <sgarz...@redhat.com>
>
> Coverity reported a file descriptor leak (CID 1490785) that happens if
> `vhost_vdpa_get_max_queue_pairs()` returns 0, since in that case
> net_host_vdpa_init(), which should take ownership of the fd, is never
> called.
>
> vhost_vdpa_get_max_queue_pairs() returns 1 if VIRTIO_NET_F_MQ is not
> negotiated, or a negative error if the ioctl() fails, or the maximum
> number of queue pairs exposed by the device in the config space in the
> `max_virtqueue_pairs` field. In the VIRTIO spec we have:
> The device MUST set max_virtqueue_pairs to between 1 and 0x8000
> inclusive, if it offers VIRTIO_NET_F_MQ.
>
> So, if `vhost_vdpa_get_max_queue_pairs()` returns 0, it's really an
> error since the device is violating the VIRTIO spec.
>
> Treat also `queue_pairs == 0` as an error, and jump to the `err` label,
> to return a negative value to the caller in any case.
>
> Coverity: CID 1490785
> Suggested-by: Peter Maydell <peter.mayd...@linaro.org>
> Signed-off-by: Stefano Garzarella <sgarz...@redhat.com>
> ---
> net/vhost-vdpa.c | 5 ++---
> 1 file changed, 2 insertions(+), 3 deletions(-)
>
> diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
> index 58d738945d..9dc7d2cb23 100644
> --- a/net/vhost-vdpa.c
> +++ b/net/vhost-vdpa.c
> @@ -1813,9 +1813,8 @@ int net_init_vhost_vdpa(const Netdev *netdev, const
> char *name,
>
> queue_pairs = vhost_vdpa_get_max_queue_pairs(vdpa_device_fd, features,
> &has_cvq, errp);
> - if (queue_pairs < 0) {
> - qemu_close(vdpa_device_fd);
> - return queue_pairs;
> + if (queue_pairs <= 0) {
> + goto err;
> }
>
> r = vhost_vdpa_get_iova_range(vdpa_device_fd, &iova_range);
> --
> 2.50.1
>
>
Reviewed-by: Manos Pitsidianakis <manos.pitsidiana...@linaro.org>
