Skip to content

Commit

Permalink
vhost: fix virtqueue use after free on NUMA reallocation
Browse files Browse the repository at this point in the history
translate_ring_addresses (via numa_realloc) may change a virtio device and
virtio queue.
The virtqueue object must be refreshed before accessing the lock.

Fixes: 04c27cb ("vhost: fix unsafe vring addresses modifications")
Cc: stable@dpdk.org

Signed-off-by: David Marchand <david.marchand@redhat.com>
Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>
  • Loading branch information
david-marchand authored and tmonjalo committed Sep 15, 2022
1 parent d5b39b6 commit 0b2a2ca
Showing 1 changed file with 1 addition and 0 deletions.
1 change: 1 addition & 0 deletions lib/vhost/vhost_user.c
Original file line number Diff line number Diff line change
Expand Up @@ -2596,6 +2596,7 @@ vhost_user_iotlb_msg(struct virtio_net **pdev,
if (is_vring_iotlb(dev, vq, imsg)) {
rte_spinlock_lock(&vq->access_lock);
*pdev = dev = translate_ring_addresses(dev, i);
vq = dev->virtqueue[i];
rte_spinlock_unlock(&vq->access_lock);
}
}
Expand Down

0 comments on commit 0b2a2ca

Please sign in to comment.