From ad5050e42ea0575cffe50142d60a5f47d5915add Mon Sep 17 00:00:00 2001 From: Wenwu Ma Date: Fri, 24 Sep 2021 17:23:00 +0000 Subject: [PATCH] examples/vhost: fix use after free on drain When a vdev is removed in destroy_device function, the corresponding vhost TX buffer will also be freed, but the vhost TX buffer may still be used in the drain_vhost function, which will cause an error of heap-use-after-free. Therefore, before accessing vhost TX buffer, we need to check whether the vdev has been removed, if so, let's skip this vdev. Fixes: a68ba8e0a6b6 ("examples/vhost: refactor vhost data path") Cc: stable@dpdk.org Signed-off-by: Wenwu Ma Reviewed-by: Chenbo Xia --- examples/vhost/main.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/examples/vhost/main.c b/examples/vhost/main.c index 999809e6ed..9721891706 100644 --- a/examples/vhost/main.c +++ b/examples/vhost/main.c @@ -914,6 +914,9 @@ drain_vhost_table(void) uint64_t cur_tsc; TAILQ_FOREACH(vdev, &vhost_dev_list, global_vdev_entry) { + if (unlikely(vdev->remove == 1)) + continue; + vhost_txq = vhost_txbuff[lcore_id * MAX_VHOST_DEVICE + vdev->vid];