net/vdpa: fix potential fd leak in net_init_vhost_vdpa()

[PATCH] net/vdpa: fix potential fd leak in net_init_vhost_vdpa()

Posted by Stefano Garzarella 4 months ago

From: Stefano Garzarella <sgarzare@redhat.com>

Coverity reported a file descriptor leak (CID 1490785) that happens if
`vhost_vdpa_get_max_queue_pairs()` returns 0, since in that case
net_host_vdpa_init(), which should take ownership of the fd, is never
called.

vhost_vdpa_get_max_queue_pairs() returns 1 if VIRTIO_NET_F_MQ is not
negotiated, or a negative error if the ioctl() fails, or the maximum
number of queue pairs exposed by the device in the config space in the
`max_virtqueue_pairs` field. In the VIRTIO spec we have:
     The device MUST set max_virtqueue_pairs to between 1 and 0x8000
     inclusive, if it offers VIRTIO_NET_F_MQ.

So, if `vhost_vdpa_get_max_queue_pairs()` returns 0, it's really an
error since the device is violating the VIRTIO spec.

Treat also `queue_pairs == 0` as an error, and jump to the `err` label,
to return a negative value to the caller in any case.

Coverity: CID 1490785
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
---
 net/vhost-vdpa.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index 58d738945d..9dc7d2cb23 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -1813,9 +1813,8 @@ int net_init_vhost_vdpa(const Netdev *netdev, const char *name,
 
     queue_pairs = vhost_vdpa_get_max_queue_pairs(vdpa_device_fd, features,
                                                  &has_cvq, errp);
-    if (queue_pairs < 0) {
-        qemu_close(vdpa_device_fd);
-        return queue_pairs;
+    if (queue_pairs <= 0) {
+        goto err;
     }
 
     r = vhost_vdpa_get_iova_range(vdpa_device_fd, &iova_range);
-- 
2.50.1

Re: [PATCH] net/vdpa: fix potential fd leak in net_init_vhost_vdpa()

Posted by Jason Wang 4 months ago

On Mon, Jul 14, 2025 at 6:12 PM Stefano Garzarella <sgarzare@redhat.com> wrote:
>
> From: Stefano Garzarella <sgarzare@redhat.com>
>
> Coverity reported a file descriptor leak (CID 1490785) that happens if
> `vhost_vdpa_get_max_queue_pairs()` returns 0, since in that case
> net_host_vdpa_init(), which should take ownership of the fd, is never
> called.
>
> vhost_vdpa_get_max_queue_pairs() returns 1 if VIRTIO_NET_F_MQ is not
> negotiated, or a negative error if the ioctl() fails, or the maximum
> number of queue pairs exposed by the device in the config space in the
> `max_virtqueue_pairs` field. In the VIRTIO spec we have:
>      The device MUST set max_virtqueue_pairs to between 1 and 0x8000
>      inclusive, if it offers VIRTIO_NET_F_MQ.
>
> So, if `vhost_vdpa_get_max_queue_pairs()` returns 0, it's really an
> error since the device is violating the VIRTIO spec.
>
> Treat also `queue_pairs == 0` as an error, and jump to the `err` label,
> to return a negative value to the caller in any case.
>
> Coverity: CID 1490785
> Suggested-by: Peter Maydell <peter.maydell@linaro.org>
> Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
> ---
>  net/vhost-vdpa.c | 5 ++---
>  1 file changed, 2 insertions(+), 3 deletions(-)
>
> diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
> index 58d738945d..9dc7d2cb23 100644
> --- a/net/vhost-vdpa.c
> +++ b/net/vhost-vdpa.c
> @@ -1813,9 +1813,8 @@ int net_init_vhost_vdpa(const Netdev *netdev, const char *name,
>
>      queue_pairs = vhost_vdpa_get_max_queue_pairs(vdpa_device_fd, features,
>                                                   &has_cvq, errp);
> -    if (queue_pairs < 0) {
> -        qemu_close(vdpa_device_fd);
> -        return queue_pairs;
> +    if (queue_pairs <= 0) {
> +        goto err;
>      }
>
>      r = vhost_vdpa_get_iova_range(vdpa_device_fd, &iova_range);
> --
> 2.50.1
>

Acked-by: Jason Wang <jasowang@redhat.com>

Thanks

Re: [PATCH] net/vdpa: fix potential fd leak in net_init_vhost_vdpa()

Posted by Manos Pitsidianakis 4 months ago

On Mon, Jul 14, 2025 at 1:14 PM Stefano Garzarella <sgarzare@redhat.com> wrote:
>
> From: Stefano Garzarella <sgarzare@redhat.com>
>
> Coverity reported a file descriptor leak (CID 1490785) that happens if
> `vhost_vdpa_get_max_queue_pairs()` returns 0, since in that case
> net_host_vdpa_init(), which should take ownership of the fd, is never
> called.
>
> vhost_vdpa_get_max_queue_pairs() returns 1 if VIRTIO_NET_F_MQ is not
> negotiated, or a negative error if the ioctl() fails, or the maximum
> number of queue pairs exposed by the device in the config space in the
> `max_virtqueue_pairs` field. In the VIRTIO spec we have:
>      The device MUST set max_virtqueue_pairs to between 1 and 0x8000
>      inclusive, if it offers VIRTIO_NET_F_MQ.
>
> So, if `vhost_vdpa_get_max_queue_pairs()` returns 0, it's really an
> error since the device is violating the VIRTIO spec.
>
> Treat also `queue_pairs == 0` as an error, and jump to the `err` label,
> to return a negative value to the caller in any case.
>
> Coverity: CID 1490785
> Suggested-by: Peter Maydell <peter.maydell@linaro.org>
> Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
> ---
>  net/vhost-vdpa.c | 5 ++---
>  1 file changed, 2 insertions(+), 3 deletions(-)
>
> diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
> index 58d738945d..9dc7d2cb23 100644
> --- a/net/vhost-vdpa.c
> +++ b/net/vhost-vdpa.c
> @@ -1813,9 +1813,8 @@ int net_init_vhost_vdpa(const Netdev *netdev, const char *name,
>
>      queue_pairs = vhost_vdpa_get_max_queue_pairs(vdpa_device_fd, features,
>                                                   &has_cvq, errp);
> -    if (queue_pairs < 0) {
> -        qemu_close(vdpa_device_fd);
> -        return queue_pairs;
> +    if (queue_pairs <= 0) {
> +        goto err;
>      }
>
>      r = vhost_vdpa_get_iova_range(vdpa_device_fd, &iova_range);
> --
> 2.50.1
>
>

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>