Commit 4539ac58 authored Jun 18, 2020 by Jin Yu Committed by Tomasz Zawadzki Jun 19, 2020

vhost: fix vhost_blk_destroy issue



If the vhost dev can't unregister successfully then we
leave the io channel and desc. In the bdev remove callback
we will free them or It would cause heap-use-after-free
issue.

Fix github issue: #1443

Change-Id: I09f4616e181d6657add3acef0ff92336fb9a9643
Signed-off-by: Jin Yu <jin.yu@intel.com>
Reviewed-on: https://review.spdk.io/gerrit/c/spdk/spdk/+/2924


Community-CI: Mellanox Build Bot
Community-CI: Broadcom CI
Tested-by: SPDK CI Jenkins <sys_sgci@intel.com>
Reviewed-by:  <dongx.yi@intel.com>
Reviewed-by: Changpeng Liu <changpeng.liu@intel.com>
Reviewed-by: Shuhei Matsumoto <shuhei.matsumoto.xt@hitachi.com>

parent a37fd6e0

lib/vhost/vhost_blk.c

+5 −5

Original line number	Diff line number	Diff line
		@@ -1280,16 +1280,16 @@ vhost_blk_destroy(struct spdk_vhost_dev *vdev)

		assert(bvdev != NULL);

		/* if the bdev is removed, don't need call spdk_put_io_channel. */
		if (bvdev->bdev) {
		spdk_put_io_channel(bvdev->dummy_io_channel);
		}

		rc = vhost_dev_unregister(&bvdev->vdev);
		if (rc != 0) {
		return rc;
		}

		/* if the bdev is removed, don't need call spdk_put_io_channel. */
		if (bvdev->bdev) {
		spdk_put_io_channel(bvdev->dummy_io_channel);
		}

		if (bvdev->bdev_desc) {
		spdk_bdev_close(bvdev->bdev_desc);
		bvdev->bdev_desc = NULL;