From: David Marchand <david.marchand@redhat.com> To: Quentin Armitage <quentin@armitage.org.uk> Cc: dev <dev@dpdk.org>, Harman Kalra <hkalra@marvell.com>, dpdk stable <stable@dpdk.org> Subject: Re: [PATCH v2] tap: fix write-after-free and double free of intr_handle Date: Wed, 4 May 2022 13:17:25 +0200 Message-ID: <CAJFAV8wDsjaeUyjwpjQjBhwFG_HpYkckkQx9vN6T0+-1JtSX0g@mail.gmail.com> (raw) In-Reply-To: <20220503152732.390513-1-quentin@armitage.org.uk> On Tue, May 3, 2022 at 8:23 PM Quentin Armitage <quentin@armitage.org.uk> wrote: > > rte_pmd_tun/tap_probe() allocates pmd->intr_handle in eth_dev_tap_create() > and it should not be freed until rte_pmd_tap_remove() is called. > > Inspection of tap_rx_intr_vec_set() shows that the call to > tap_tx_intr_vec_uninstall() was calling rte_intr_instance_free() but > tap_tx_intr_vec_install() can then be immediately called, and this then > uses pmd->intr_handle without it being reallocated. > > This commit moves the call of rte_intr_instance_free() from > tap_tx_intr_vec_uninstall() to rte_pmd_tap_remove(). > > Fixes: d61138d4f0e2 ("drivers: remove direct access to interrupt handle") Cc: stable@dpdk.org https://doc.dpdk.org/guides/contributing/patches.html#patch-for-stable-releases The reason is that backport scripts look for a "Cc: stable@dpdk.org" in the commitlog itself. (no need for a v3 just for this, it can be fixed when applying) > > Changes in v2: > Move rte_intr_instance_free() from tap_rx_intr_vec_uninstall() > to tap_dev_close(). Nit: revisions changelog should be added as annotations (i.e. put after the --- after the commitlog). > > Signed-off-by: Quentin Armitage <quentin@armitage.org.uk> I did not test the change, but the fix lgtm. The CI failure from UNH is a false positive. Reviewed-by: David Marchand <david.marchand@redhat.com> -- David Marchand
next prev parent reply other threads:[~2022-05-04 11:17 UTC|newest] Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top 2022-05-03 15:27 Quentin Armitage 2022-05-04 11:17 ` David Marchand [this message] 2022-05-12 8:12 ` Andrew Rybchenko
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=CAJFAV8wDsjaeUyjwpjQjBhwFG_HpYkckkQx9vN6T0+-1JtSX0g@mail.gmail.com \ --to=david.marchand@redhat.com \ --cc=dev@dpdk.org \ --cc=hkalra@marvell.com \ --cc=quentin@armitage.org.uk \ --cc=stable@dpdk.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
DPDK patches and discussions This inbox may be cloned and mirrored by anyone: git clone --mirror http://inbox.dpdk.org/dev/0 dev/git/0.git # If you have public-inbox 1.1+ installed, you may # initialize and index your mirror using the following commands: public-inbox-init -V2 dev dev/ http://inbox.dpdk.org/dev \ dev@dpdk.org public-inbox-index dev Example config snippet for mirrors. Newsgroup available over NNTP: nntp://inbox.dpdk.org/inbox.dpdk.dev AGPL code for this site: git clone https://public-inbox.org/public-inbox.git