[dpdk-dev] [PATCH] lib/rte_eal: fix heap-use-after-free bug

[Wei Hu (Xavier)]

From: "Wei Hu (Xavier)" <xavier.hu...@huawei.com>

This patch fixes the heap-use-after-free bug which was found by ASAN
(Address-Sanitizer) in the vfio_get_default_container_fd function.

Fixes: 6bcb7c95fe14 ("vfio: share default container in multi-process")
Cc: sta...@dpdk.org

Signed-off-by: Chengwen Feng <fengcheng...@huawei.com>
Signed-off-by: Wei Hu (Xavier) <xavier.hu...@huawei.com>
---
 lib/librte_eal/linux/eal_vfio.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/librte_eal/linux/eal_vfio.c b/lib/librte_eal/linux/eal_vfio.c
index 4502aefed..1470b58c6 100644
--- a/lib/librte_eal/linux/eal_vfio.c
+++ b/lib/librte_eal/linux/eal_vfio.c
@@ -1092,6 +1092,7 @@ vfio_get_default_container_fd(void)
        struct rte_mp_reply mp_reply = {0};
        struct timespec ts = {.tv_sec = 5, .tv_nsec = 0};
        struct vfio_mp_param *p = (struct vfio_mp_param *)mp_req.param;
+       int container_fd;
 
        if (default_vfio_cfg->vfio_enabled)
                return default_vfio_cfg->vfio_container_fd;
@@ -1114,8 +1115,9 @@ vfio_get_default_container_fd(void)
                mp_rep = &mp_reply.msgs[0];
                p = (struct vfio_mp_param *)mp_rep->param;
                if (p->result == SOCKET_OK && mp_rep->num_fds == 1) {
+                       container_fd = mp_rep->fds[0];
                        free(mp_reply.msgs);
-                       return mp_rep->fds[0];
+                       return container_fd;
                }
        }
 
-- 
2.23.0