Skip to content
Permalink
Browse files Browse the repository at this point in the history
vhost: fix FD leak with inflight messages
Even if unlikely, a buggy vhost-user master might attach fds to inflight
messages. Add checks like for other types of vhost-user messages.

Fixes: d87f1a1 ("vhost: support inflight info sharing")
Cc: stable@dpdk.org

Signed-off-by: David Marchand <david.marchand@redhat.com>
Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>
  • Loading branch information
david-marchand committed Mar 10, 2022
1 parent 6442c32 commit af74f7d
Showing 1 changed file with 6 additions and 0 deletions.
6 changes: 6 additions & 0 deletions lib/vhost/vhost_user.c
Expand Up @@ -1602,6 +1602,9 @@ vhost_user_get_inflight_fd(struct virtio_net **pdev,
int numa_node = SOCKET_ID_ANY;
void *addr;

if (validate_msg_fds(dev, ctx, 0) != 0)
return RTE_VHOST_MSG_RESULT_ERR;

if (ctx->msg.size != sizeof(ctx->msg.payload.inflight)) {
VHOST_LOG_CONFIG(ERR, "(%s) invalid get_inflight_fd message size is %d\n",
dev->ifname, ctx->msg.size);
Expand Down Expand Up @@ -1699,6 +1702,9 @@ vhost_user_set_inflight_fd(struct virtio_net **pdev,
int fd, i;
int numa_node = SOCKET_ID_ANY;

if (validate_msg_fds(dev, ctx, 1) != 0)
return RTE_VHOST_MSG_RESULT_ERR;

fd = ctx->fds[0];
if (ctx->msg.size != sizeof(ctx->msg.payload.inflight) || fd < 0) {
VHOST_LOG_CONFIG(ERR, "(%s) invalid set_inflight_fd message size is %d,fd is %d\n",
Expand Down

0 comments on commit af74f7d

Please sign in to comment.