vhost: fix potential fd leak

[dpdk.git] / lib / librte_vhost / vhost_user.c

diff --git a/lib/librte_vhost/vhost_user.c b/lib/librte_vhost/vhost_user.c
index 6f85084..84bebad 100644 (file)
--- a/lib/librte_vhost/vhost_user.c
+++ b/lib/librte_vhost/vhost_user.c
@@ -191,7 +191,7 @@ vhost_backend_cleanup(struct virtio_net *dev)
                dev->mem = NULL;
        }
 
-       free(dev->guest_pages);
+       rte_free(dev->guest_pages);
        dev->guest_pages = NULL;
 
        if (dev->log_addr) {
@@ -206,7 +206,7 @@ vhost_backend_cleanup(struct virtio_net *dev)
                        dev->inflight_info->addr = NULL;
                }
 
-               if (dev->inflight_info->fd > 0) {
+               if (dev->inflight_info->fd >= 0) {
                        close(dev->inflight_info->fd);
                        dev->inflight_info->fd = -1;
                }
@@ -903,11 +903,12 @@ add_one_guest_page(struct virtio_net *dev, uint64_t guest_phys_addr,
        if (dev->nr_guest_pages == dev->max_guest_pages) {
                dev->max_guest_pages *= 2;
                old_pages = dev->guest_pages;
-               dev->guest_pages = realloc(dev->guest_pages,
-                                       dev->max_guest_pages * sizeof(*page));
-               if (!dev->guest_pages) {
+               dev->guest_pages = rte_realloc(dev->guest_pages,
+                                       dev->max_guest_pages * sizeof(*page),
+                                       RTE_CACHE_LINE_SIZE);
+               if (dev->guest_pages == NULL) {
                        VHOST_LOG_CONFIG(ERR, "cannot realloc guest_pages\n");
-                       free(old_pages);
+                       rte_free(old_pages);
                        return -1;
                }
        }
@@ -964,6 +965,12 @@ add_guest_pages(struct virtio_net *dev, struct rte_vhost_mem_region *reg,
                reg_size -= size;
        }
 
+       /* sort guest page array if over binary search threshold */
+       if (dev->nr_guest_pages >= VHOST_BINARY_SEARCH_THRESH) {
+               qsort((void *)dev->guest_pages, dev->nr_guest_pages,
+                       sizeof(struct guest_page), guest_page_addrcmp);
+       }
+
        return 0;
 }
 
@@ -1062,10 +1069,12 @@ vhost_user_set_mem_table(struct virtio_net **pdev, struct VhostUserMsg *msg,
                        vhost_user_iotlb_flush_all(dev->virtqueue[i]);
 
        dev->nr_guest_pages = 0;
-       if (!dev->guest_pages) {
+       if (dev->guest_pages == NULL) {
                dev->max_guest_pages = 8;
-               dev->guest_pages = malloc(dev->max_guest_pages *
-                                               sizeof(struct guest_page));
+               dev->guest_pages = rte_zmalloc(NULL,
+                                       dev->max_guest_pages *
+                                       sizeof(struct guest_page),
+                                       RTE_CACHE_LINE_SIZE);
                if (dev->guest_pages == NULL) {
                        VHOST_LOG_CONFIG(ERR,
                                "(%d) failed to allocate memory "
@@ -1408,6 +1417,7 @@ vhost_user_get_inflight_fd(struct virtio_net **pdev,
                                "failed to alloc dev inflight area\n");
                        return RTE_VHOST_MSG_RESULT_ERR;
                }
+               dev->inflight_info->fd = -1;
        }
 
        num_queues = msg->payload.inflight.num_queues;
@@ -1433,6 +1443,16 @@ vhost_user_get_inflight_fd(struct virtio_net **pdev,
        }
        memset(addr, 0, mmap_size);
 
+       if (dev->inflight_info->addr) {
+               munmap(dev->inflight_info->addr, dev->inflight_info->size);
+               dev->inflight_info->addr = NULL;
+       }
+
+       if (dev->inflight_info->fd >= 0) {
+               close(dev->inflight_info->fd);
+               dev->inflight_info->fd = -1;
+       }
+
        dev->inflight_info->addr = addr;
        dev->inflight_info->size = msg->payload.inflight.mmap_size = mmap_size;
        dev->inflight_info->fd = msg->fds[0] = fd;
@@ -1515,10 +1535,13 @@ vhost_user_set_inflight_fd(struct virtio_net **pdev, VhostUserMsg *msg,
                                "failed to alloc dev inflight area\n");
                        return RTE_VHOST_MSG_RESULT_ERR;
                }
+               dev->inflight_info->fd = -1;
        }
 
-       if (dev->inflight_info->addr)
+       if (dev->inflight_info->addr) {
                munmap(dev->inflight_info->addr, dev->inflight_info->size);
+               dev->inflight_info->addr = NULL;
+       }
 
        addr = mmap(0, mmap_size, PROT_READ | PROT_WRITE, MAP_SHARED,
                    fd, mmap_offset);
@@ -1527,8 +1550,10 @@ vhost_user_set_inflight_fd(struct virtio_net **pdev, VhostUserMsg *msg,
                return RTE_VHOST_MSG_RESULT_ERR;
        }
 
-       if (dev->inflight_info->fd)
+       if (dev->inflight_info->fd >= 0) {
                close(dev->inflight_info->fd);
+               dev->inflight_info->fd = -1;
+       }
 
        dev->inflight_info->fd = fd;
        dev->inflight_info->addr = addr;
@@ -2059,10 +2084,10 @@ vhost_user_set_log_base(struct virtio_net **pdev, struct VhostUserMsg *msg,
        size = msg->payload.log.mmap_size;
        off  = msg->payload.log.mmap_offset;
 
-       /* Don't allow mmap_offset to point outside the mmap region */
-       if (off > size) {
+       /* Check for mmap size and offset overflow. */
+       if (off >= -size) {
                VHOST_LOG_CONFIG(ERR,
-                       "log offset %#"PRIx64" exceeds log size %#"PRIx64"\n",
+                       "log offset %#"PRIx64" and log size %#"PRIx64" overflow\n",
                        off, size);
                return RTE_VHOST_MSG_RESULT_ERR;
        }
@@ -2525,7 +2550,7 @@ static int
 vhost_user_check_and_alloc_queue_pair(struct virtio_net *dev,
                        struct VhostUserMsg *msg)
 {
-       uint16_t vring_idx;
+       uint32_t vring_idx;
 
        switch (msg->request.master) {
        case VHOST_USER_SET_VRING_KICK: