Hi Wenwu,
> -----Original Message-----
> From: Ma, WenwuX <wenwux...@intel.com>
> Sent: Friday, September 24, 2021 4:30 AM
> To: dev@dpdk.org
> Cc: maxime.coque...@redhat.com; Xia, Chenbo <chenbo....@intel.com>; Hu, Jiayu
> <jiayu...@intel.com>; Yang, YvonneX <yvonnex.y...@intel.com>; Ma, WenwuX
> <wenwux...@intel.com>
> Subject: [PATCH] examples/vhost: fix use-after-free on drain vhost
>
> When a vdev is removed in destroy_device function,
> the corresponding vhost_txbuff[vdev->vid] will also
> be free, but the vhost_txbuff[vdev->vid] may still
Free -> freed
vhost_txbuff[vdev->vid] -> vhost TX buffer
> be used in the drain_vhost function, which will cause
> an error of heap-use-after-free. Therefore, before
> accessing vhost_txbuff[vdev->vid], we need to check
> whether the vdev has been removed, if so, let's skip
> this vdev.
This is a bug fix. Please add fix and cc-stable tag.
Thanks,
Chenbo
>
> Signed-off-by: Wenwu Ma <wenwux...@intel.com>
> ---
> examples/vhost/main.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/examples/vhost/main.c b/examples/vhost/main.c
> index d0bf1f31e3..1f6f7be8e3 100644
> --- a/examples/vhost/main.c
> +++ b/examples/vhost/main.c
> @@ -916,6 +916,9 @@ drain_vhost_table(void)
> uint64_t cur_tsc;
>
> TAILQ_FOREACH(vdev, &vhost_dev_list, global_vdev_entry) {
> + if (unlikely(vdev->remove == 1))
> + continue;
> +
> vhost_txq = vhost_txbuff[lcore_id * MAX_VHOST_DEVICE
> + vdev->vid];
>
> --
> 2.25.1
