From: Wenwu Ma <wenwux.ma@intel.com>
Date: Fri, 24 Sep 2021 17:23:00 +0000 (+0000)
Subject: examples/vhost: fix use after free on drain
X-Git-Url: http://git.droids-corp.org/?a=commitdiff_plain;h=ad5050e42ea0575cffe50142d60a5f47d5915add;p=dpdk.git

examples/vhost: fix use after free on drain

When a vdev is removed in destroy_device function,
the corresponding vhost TX buffer will also be freed,
but the vhost TX buffer may still be used in the
drain_vhost function, which will cause an error of
heap-use-after-free. Therefore, before accessing
vhost TX buffer, we need to check whether the vdev
has been removed, if so, let's skip this vdev.

Fixes: a68ba8e0a6b6 ("examples/vhost: refactor vhost data path")
Cc: stable@dpdk.org

Signed-off-by: Wenwu Ma <wenwux.ma@intel.com>
Reviewed-by: Chenbo Xia <chenbo.xia@intel.com>
---

diff --git a/examples/vhost/main.c b/examples/vhost/main.c
index 999809e6ed..9721891706 100644
--- a/examples/vhost/main.c
+++ b/examples/vhost/main.c
@@ -914,6 +914,9 @@ drain_vhost_table(void)
 	uint64_t cur_tsc;
 
 	TAILQ_FOREACH(vdev, &vhost_dev_list, global_vdev_entry) {
+		if (unlikely(vdev->remove == 1))
+			continue;
+
 		vhost_txq = vhost_txbuff[lcore_id * MAX_VHOST_DEVICE
 						+ vdev->vid];