[dpdk-dev] [PATCH] lib/rte_eal: fix heap-use-after-free bug
Wei Hu (Xavier)
huwei013 at chinasoftinc.com
Tue Apr 21 05:29:57 CEST 2020
From: "Wei Hu (Xavier)" <xavier.huwei at huawei.com>
This patch fixes the heap-use-after-free bug which was found by ASAN
(Address-Sanitizer) in the vfio_get_default_container_fd function.
Fixes: 6bcb7c95fe14 ("vfio: share default container in multi-process")
Cc: stable at dpdk.org
Signed-off-by: Chengwen Feng <fengchengwen at huawei.com>
Signed-off-by: Wei Hu (Xavier) <xavier.huwei at huawei.com>
---
lib/librte_eal/linux/eal_vfio.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/lib/librte_eal/linux/eal_vfio.c b/lib/librte_eal/linux/eal_vfio.c
index 4502aefed..1470b58c6 100644
--- a/lib/librte_eal/linux/eal_vfio.c
+++ b/lib/librte_eal/linux/eal_vfio.c
@@ -1092,6 +1092,7 @@ vfio_get_default_container_fd(void)
struct rte_mp_reply mp_reply = {0};
struct timespec ts = {.tv_sec = 5, .tv_nsec = 0};
struct vfio_mp_param *p = (struct vfio_mp_param *)mp_req.param;
+ int container_fd;
if (default_vfio_cfg->vfio_enabled)
return default_vfio_cfg->vfio_container_fd;
@@ -1114,8 +1115,9 @@ vfio_get_default_container_fd(void)
mp_rep = &mp_reply.msgs[0];
p = (struct vfio_mp_param *)mp_rep->param;
if (p->result == SOCKET_OK && mp_rep->num_fds == 1) {
+ container_fd = mp_rep->fds[0];
free(mp_reply.msgs);
- return mp_rep->fds[0];
+ return container_fd;
}
}
--
2.23.0
More information about the dev
mailing list