d/numam-dpdk
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

vfio: fix use after free with multiprocess

Browse Source 
This patch fixes the heap-use-after-free bug which was found by ASAN
(Address-Sanitizer) in the vfio_get_default_container_fd function.

Fixes: 6bcb7c95fe ("vfio: share default container in multi-process")
Cc: stable@dpdk.org

Signed-off-by: Chengwen Feng <fengchengwen@huawei.com>
Signed-off-by: Wei Hu (Xavier) <xavier.huwei@huawei.com>
Acked-by: Anatoly Burakov <anatoly.burakov@intel.com>
This commit is contained in:
Wei Hu (Xavier) 2020-04-21 11:29:57 +08:00 committed by David Marchand
parent b758423bc4
commit d6298844da
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
lib/librte_eal/linux/eal_vfio.c
View File

@ -1092,6 +1092,7 @@ vfio_get_default_container_fd(void)
struct rte_mp_reply mp_reply = {0};
struct timespec ts = {.tv_sec = 5, .tv_nsec = 0};
struct vfio_mp_param *p = (struct vfio_mp_param *)mp_req.param;
int container_fd;
if (default_vfio_cfg->vfio_enabled)
return default_vfio_cfg->vfio_container_fd;
@ -1114,8 +1115,9 @@ vfio_get_default_container_fd(void)
mp_rep = &mp_reply.msgs[0];
p = (struct vfio_mp_param *)mp_rep->param;
if (p->result == SOCKET_OK && mp_rep->num_fds == 1) {
container_fd = mp_rep->fds[0];
free(mp_reply.msgs);
return mp_rep->fds[0];
return container_fd;
}
}