From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 584BA43B53; Tue, 20 Feb 2024 10:31:47 +0100 (CET) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 49CE0402D1; Tue, 20 Feb 2024 10:31:46 +0100 (CET) Received: from szxga01-in.huawei.com (szxga01-in.huawei.com [45.249.212.187]) by mails.dpdk.org (Postfix) with ESMTP id E1A27402B8; Tue, 20 Feb 2024 10:31:43 +0100 (CET) Received: from mail.maildlp.com (unknown [172.19.88.194]) by szxga01-in.huawei.com (SkyGuard) with ESMTP id 4TfDdJ4MkbzvVqZ; Tue, 20 Feb 2024 17:29:40 +0800 (CST) Received: from dggpemm500008.china.huawei.com (unknown [7.185.36.136]) by mail.maildlp.com (Postfix) with ESMTPS id DDF361400FD; Tue, 20 Feb 2024 17:31:41 +0800 (CST) Received: from localhost (10.174.242.157) by dggpemm500008.china.huawei.com (7.185.36.136) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.35; Tue, 20 Feb 2024 17:31:41 +0800 From: Yunjian Wang To: CC: , , , , , , Pengfei Sun , Subject: [PATCH] net/mlx5: fix use after free when releasing tx queues Date: Tue, 20 Feb 2024 17:31:39 +0800 Message-ID: <1708421499-42236-1-git-send-email-wangyunjian@huawei.com> X-Mailer: git-send-email 1.9.5.msysgit.1 MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [10.174.242.157] X-ClientProxiedBy: dggems706-chm.china.huawei.com (10.3.19.183) To dggpemm500008.china.huawei.com (7.185.36.136) X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org From: Pengfei Sun In function mlx5_dev_configure, dev->data->tx_queues is assigned to priv->txqs. When a member is removed from a bond, the function eth_dev_tx_queue_config is called to release dev->data->tx_queues. However, function mlx5_dev_close will access priv->txqs again and cause the use after free problem. In function mlx5_dev_close, before free priv->txqs, we add a check that dev->data->tx_queues is not NULL. build/app/dpdk-testpmd -c7 -a 0000:08:00.2 -- -i --nb-cores=2 --total-num-mbufs=2048 testpmd> port stop 0 testpmd> create bonding device 4 0 testpmd> add bonding member 0 1 testpmd> remove bonding member 0 1 testpmd> quit ASan reports: ==2571911==ERROR: AddressSanitizer: heap-use-after-free on address 0x000174529880 at pc 0x0000113c8440 bp 0xffffefae0ea0 sp 0xffffefae0eb0 READ of size 8 at 0x000174529880 thread T0 #0 0x113c843c in mlx5_txq_release ../drivers/net/mlx5/mlx5_txq.c: 1203 #1 0xffdb53c in mlx5_dev_close ../drivers/net/mlx5/mlx5.c:2286 #2 0xe12dc0 in rte_eth_dev_close ../lib/ethdev/rte_ethdev.c:1877 #3 0x6bac1c in close_port ../app/test-pmd/testpmd.c:3540 #4 0x6bc320 in pmd_test_exit ../app/test-pmd/testpmd.c:3808 #5 0x6c1a94 in main ../app/test-pmd/testpmd.c:4759 #6 0xffff9328f038 (/usr/lib64/libc.so.6+0x2b038) #7 0xffff9328f110 in __libc_start_main (/usr/lib64/libc.so.6+ 0x2b110) Fixes: 6e78005 ("net/mlx5: add reference counter on DPDK Tx queues") Cc: stable@dpdk.org Reported-by: Yunjian Wang Signed-off-by: Pengfei Sun --- drivers/net/mlx5/mlx5.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/mlx5/mlx5.c b/drivers/net/mlx5/mlx5.c index 3a182de..6b5a4da 100644 --- a/drivers/net/mlx5/mlx5.c +++ b/drivers/net/mlx5/mlx5.c @@ -2279,7 +2279,7 @@ mlx5_dev_close(struct rte_eth_dev *dev) mlx5_free(priv->rxq_privs); priv->rxq_privs = NULL; } - if (priv->txqs != NULL) { + if (priv->txqs != NULL && dev->data->tx_queues != NULL) { /* XXX race condition if mlx5_tx_burst() is still running. */ rte_delay_us_sleep(1000); for (i = 0; (i != priv->txqs_n); ++i) -- 2.33.0