DPDK patches and discussions
 help / color / mirror / Atom feed
From: Quentin Armitage <quentin@armitage.org.uk>
To: dev <dev@dpdk.org>
Cc: David Marchand <david.marchand@redhat.com>,
	Harman Kalra <hkalra@marvell.com>,
	stable@dpdk.org, Quentin Armitage <quentin@armitage.org.uk>
Subject: [PATCH v2] tap: fix write-after-free and double free of intr_handle
Date: Tue,  3 May 2022 16:27:32 +0100
Message-ID: <20220503152732.390513-1-quentin@armitage.org.uk> (raw)

rte_pmd_tun/tap_probe() allocates pmd->intr_handle in eth_dev_tap_create()
and it should not be freed until rte_pmd_tap_remove() is called.

Inspection of tap_rx_intr_vec_set() shows that the call to
tap_tx_intr_vec_uninstall() was calling rte_intr_instance_free() but
tap_tx_intr_vec_install() can then be immediately called, and this then
uses pmd->intr_handle without it being reallocated.

This commit moves the call of rte_intr_instance_free() from
tap_tx_intr_vec_uninstall() to rte_pmd_tap_remove().

Fixes: d61138d4f0e2 ("drivers: remove direct access to interrupt handle")

Changes in v2:
  Move rte_intr_instance_free() from tap_rx_intr_vec_uninstall()
  to tap_dev_close().

Signed-off-by: Quentin Armitage <quentin@armitage.org.uk>
 drivers/net/tap/rte_eth_tap.c | 2 ++
 drivers/net/tap/tap_intr.c    | 2 --
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/tap/rte_eth_tap.c b/drivers/net/tap/rte_eth_tap.c
index bc3d56a311..5495818be6 100644
--- a/drivers/net/tap/rte_eth_tap.c
+++ b/drivers/net/tap/rte_eth_tap.c
@@ -1213,6 +1213,8 @@ tap_dev_close(struct rte_eth_dev *dev)
 	TAP_LOG(DEBUG, "Closing %s Ethernet device on numa %u",
 		tuntap_types[internals->type], rte_socket_id());
+	rte_intr_instance_free(internals->intr_handle);
 	if (internals->ioctl_sock != -1) {
 		internals->ioctl_sock = -1;
diff --git a/drivers/net/tap/tap_intr.c b/drivers/net/tap/tap_intr.c
index 56c343acea..a9097def1a 100644
--- a/drivers/net/tap/tap_intr.c
+++ b/drivers/net/tap/tap_intr.c
@@ -34,8 +34,6 @@ tap_rx_intr_vec_uninstall(struct rte_eth_dev *dev)
 	rte_intr_nb_efd_set(intr_handle, 0);
-	rte_intr_instance_free(intr_handle);

             reply	other threads:[~2022-05-03 15:28 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-05-03 15:27 Quentin Armitage [this message]
2022-05-04 11:17 ` David Marchand
2022-05-12  8:12   ` Andrew Rybchenko

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220503152732.390513-1-quentin@armitage.org.uk \
    --to=quentin@armitage.org.uk \
    --cc=david.marchand@redhat.com \
    --cc=dev@dpdk.org \
    --cc=hkalra@marvell.com \
    --cc=stable@dpdk.org \


* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

DPDK patches and discussions

This inbox may be cloned and mirrored by anyone:

	git clone --mirror http://inbox.dpdk.org/dev/0 dev/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 dev dev/ http://inbox.dpdk.org/dev \
	public-inbox-index dev

Example config snippet for mirrors.
Newsgroup available over NNTP:

AGPL code for this site: git clone https://public-inbox.org/public-inbox.git