From: Stefano Garzarella Date: Mon, 14 Jul 2025 10:11:56 +0000 (+0200) Subject: net/vdpa: fix potential fd leak in net_init_vhost_vdpa() X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=4caf74916d09019e61c91f8cb1166510836d35e8;p=thirdparty%2Fqemu.git net/vdpa: fix potential fd leak in net_init_vhost_vdpa() Coverity reported a file descriptor leak (CID 1490785) that happens if `vhost_vdpa_get_max_queue_pairs()` returns 0, since in that case net_host_vdpa_init(), which should take ownership of the fd, is never called. vhost_vdpa_get_max_queue_pairs() returns 1 if VIRTIO_NET_F_MQ is not negotiated, or a negative error if the ioctl() fails, or the maximum number of queue pairs exposed by the device in the config space in the `max_virtqueue_pairs` field. In the VIRTIO spec we have: The device MUST set max_virtqueue_pairs to between 1 and 0x8000 inclusive, if it offers VIRTIO_NET_F_MQ. So, if `vhost_vdpa_get_max_queue_pairs()` returns 0, it's really an error since the device is violating the VIRTIO spec. Treat also `queue_pairs == 0` as an error, and jump to the `err` label, to return a negative value to the caller in any case. Coverity: CID 1490785 Suggested-by: Peter Maydell Signed-off-by: Stefano Garzarella Message-Id: <20250714101156.30024-1-sgarzare@redhat.com> Suggested-by: Peter Maydell Signed-off-by: Stefano Garzarella Reviewed-by: Manos Pitsidianakis Acked-by: Jason Wang --- diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c index 6a30a44d2b..74d26a9497 100644 --- a/net/vhost-vdpa.c +++ b/net/vhost-vdpa.c @@ -1840,9 +1840,8 @@ int net_init_vhost_vdpa(const Netdev *netdev, const char *name, queue_pairs = vhost_vdpa_get_max_queue_pairs(vdpa_device_fd, features, &has_cvq, errp); - if (queue_pairs < 0) { - qemu_close(vdpa_device_fd); - return queue_pairs; + if (queue_pairs <= 0) { + goto err; } r = vhost_vdpa_get_iova_range(vdpa_device_fd, &iova_range);