If VHOST_USER_SET_LOG_BASE request's message size is invalid, the fd is leaked.
Fix this by closing the fd systematically as long as it is valid. Fixes: 53af5b1e0ace ("vhost: fix leak of file descriptor") Cc: sta...@dpdk.org Signed-off-by: Maxime Coquelin <maxime.coque...@redhat.com> --- lib/librte_vhost/vhost_user.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/lib/librte_vhost/vhost_user.c b/lib/librte_vhost/vhost_user.c index f4c7ce462..f06d9bb65 100644 --- a/lib/librte_vhost/vhost_user.c +++ b/lib/librte_vhost/vhost_user.c @@ -895,6 +895,7 @@ static int vhost_user_set_log_base(struct virtio_net *dev, struct VhostUserMsg *msg) { int fd = msg->fds[0]; + int ret = 0; uint64_t size, off; void *addr; @@ -907,7 +908,8 @@ vhost_user_set_log_base(struct virtio_net *dev, struct VhostUserMsg *msg) RTE_LOG(ERR, VHOST_CONFIG, "invalid log base msg size: %"PRId32" != %d\n", msg->size, (int)sizeof(VhostUserLog)); - return -1; + ret = -1; + goto out; } size = msg->payload.log.mmap_size; @@ -921,10 +923,10 @@ vhost_user_set_log_base(struct virtio_net *dev, struct VhostUserMsg *msg) * fail when offset is not page size aligned. */ addr = mmap(0, size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0); - close(fd); if (addr == MAP_FAILED) { RTE_LOG(ERR, VHOST_CONFIG, "mmap log base failed!\n"); - return -1; + ret = -1; + goto out; } /* @@ -938,7 +940,10 @@ vhost_user_set_log_base(struct virtio_net *dev, struct VhostUserMsg *msg) dev->log_base = dev->log_addr + off; dev->log_size = size; - return 0; +out: + close(fd); + + return ret; } /* -- 2.14.3