[PATCH dpdk] graph: fix use-after-free when updating edges with active graphs

[PATCH dpdk] graph: fix use-after-free when updating edges with active graphs

[Robin Jarry]

After creating at least one graph and calling rte_node_edge_update to
add a new edge on a node which is in use in the graph, the node memory
is reallocated but the active graph still has a pointer to the freed
memory.

When destroying the graph, it causes a use-after-free error detected by
libasan:

ERROR: AddressSanitizer: heap-use-after-free
READ of size 8 at 0x7c4baa5e4da8 thread T0
    #0 0x0000005ad224 in graph_node_fini lib/graph/graph.c:256
    #1 0x0000005ae657 in rte_graph_destroy lib/graph/graph.c:504
    ...

freed by thread T0 here:
    #0 0x7f1bac4e5e4b in realloc.part.0 (/lib64/libasan.so.8+0xe5e4b)
    #1 0x0000005ab6d7 in edge_update lib/graph/node.c:271
    #2 0x0000005abb1b in rte_node_edge_update lib/graph/node.c:339
    ...

previously allocated by thread T0 here:
    #0 0x7f1bac4e5e4b in realloc.part.0 (/lib64/libasan.so.8+0xe5e4b)
    #1 0x0000005ab6d7 in edge_update lib/graph/node.c:271
    #2 0x0000005abb1b in rte_node_edge_update lib/graph/node.c:339
    ...

Use malloc+memcpy and add an internal function to replace all references
to the old node memory before freeing it.

Cc: stable@dpdk.org
Fixes: c59dac2ca14a ("graph: implement node operations")

Signed-off-by: Robin Jarry <rjarry@redhat.com>
---
 lib/graph/graph.c         | 14 ++++++++++++++
 lib/graph/graph_private.h | 12 ++++++++++++
 lib/graph/node.c          |  6 +++++-
 3 files changed, 31 insertions(+), 1 deletion(-)

diff --git a/lib/graph/graph.c b/lib/graph/graph.c
index 61159edc7261..6911ea8abeed 100644
--- a/lib/graph/graph.c
+++ b/lib/graph/graph.c
@@ -277,6 +277,20 @@ graph_node_fini(struct graph *graph)
 						       graph_node->node->name));
 }
 
+void
+graph_node_replace_all(struct node *old, struct node *new)
+{
+	struct graph_node *graph_node;
+	struct graph *graph;
+
+	STAILQ_FOREACH(graph, &graph_list, next) {
+		STAILQ_FOREACH(graph_node, &graph->node_list, next) {
+			if (graph_node->node == old)
+				graph_node->node = new;
+		}
+	}
+}
+
 static struct rte_graph *
 graph_mem_fixup_node_ctx(struct rte_graph *graph)
 {
diff --git a/lib/graph/graph_private.h b/lib/graph/graph_private.h
index 21912c0ae63f..26cdc6637192 100644
--- a/lib/graph/graph_private.h
+++ b/lib/graph/graph_private.h
@@ -299,6 +299,18 @@ int graph_node_has_edge_to_src_node(struct graph *graph);
  */
 int graph_node_has_loop_edge(struct graph *graph);
 
+/**
+ * @internal
+ *
+ * Replace all pointers of a given node with another one in all active graphs.
+ *
+ * @param old
+ *   Node pointer to replace in all graphs.
+ * @param new
+ *   Updated pointer.
+ */
+void graph_node_replace_all(struct node *old, struct node *new);
+
 /**
  * @internal
  *
diff --git a/lib/graph/node.c b/lib/graph/node.c
index cae1c809edc4..e3359fe490a5 100644
--- a/lib/graph/node.c
+++ b/lib/graph/node.c
@@ -325,11 +325,15 @@ edge_update(struct node *node, struct node *prev, rte_edge_t from,
 	need_realloc = max_edges > node->nb_edges;
 	if (need_realloc) {
 		sz = sizeof(struct node) + (max_edges * RTE_NODE_NAMESIZE);
-		new_node = realloc(node, sz);
+		new_node = malloc(sz);
 		if (new_node == NULL) {
 			rte_errno = ENOMEM;
 			goto restore;
 		} else {
+			sz = sizeof(*node) + (node->nb_edges * RTE_NODE_NAMESIZE);
+			memcpy(new_node, node, sz);
+			graph_node_replace_all(node, new_node);
+			free(node);
 			node = new_node;
 		}
 	}
-- 
2.51.1