patches for DPDK stable branches
 help / color / mirror / Atom feed
From: Andrew Rybchenko <andrew.rybchenko@oktetlabs.ru>
To: David Marchand <david.marchand@redhat.com>,
	Quentin Armitage <quentin@armitage.org.uk>
Cc: dev <dev@dpdk.org>, Harman Kalra <hkalra@marvell.com>,
	dpdk stable <stable@dpdk.org>
Subject: Re: [PATCH v2] tap: fix write-after-free and double free of intr_handle
Date: Thu, 12 May 2022 11:12:36 +0300	[thread overview]
Message-ID: <67b23090-7793-46db-e9f8-c4d17069be9e@oktetlabs.ru> (raw)
In-Reply-To: <CAJFAV8wDsjaeUyjwpjQjBhwFG_HpYkckkQx9vN6T0+-1JtSX0g@mail.gmail.com>

On 5/4/22 14:17, David Marchand wrote:
> On Tue, May 3, 2022 at 8:23 PM Quentin Armitage <quentin@armitage.org.uk> wrote:
>>
>> rte_pmd_tun/tap_probe() allocates pmd->intr_handle in eth_dev_tap_create()
>> and it should not be freed until rte_pmd_tap_remove() is called.
>>
>> Inspection of tap_rx_intr_vec_set() shows that the call to
>> tap_tx_intr_vec_uninstall() was calling rte_intr_instance_free() but
>> tap_tx_intr_vec_install() can then be immediately called, and this then
>> uses pmd->intr_handle without it being reallocated.
>>
>> This commit moves the call of rte_intr_instance_free() from
>> tap_tx_intr_vec_uninstall() to rte_pmd_tap_remove().
>>
>> Fixes: d61138d4f0e2 ("drivers: remove direct access to interrupt handle")
> 
> Cc: stable@dpdk.org
> 
> https://doc.dpdk.org/guides/contributing/patches.html#patch-for-stable-releases
> The reason is that backport scripts look for a "Cc: stable@dpdk.org"
> in the commitlog itself.
> 
> (no need for a v3 just for this, it can be fixed when applying)
> 
>>
>> Changes in v2:
>>    Move rte_intr_instance_free() from tap_rx_intr_vec_uninstall()
>>    to tap_dev_close().
> 
> Nit: revisions changelog should be added as annotations (i.e. put
> after the --- after the commitlog).
> 
> 
>>
>> Signed-off-by: Quentin Armitage <quentin@armitage.org.uk>
> 
> I did not test the change, but the fix lgtm.
> The CI failure from UNH is a false positive.
> 
> Reviewed-by: David Marchand <david.marchand@redhat.com>
> 
> 

Applied with minor fixes in summary and description, thanks.

      reply	other threads:[~2022-05-12  8:12 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-05-03 15:27 Quentin Armitage
2022-05-04 11:17 ` David Marchand
2022-05-12  8:12   ` Andrew Rybchenko [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=67b23090-7793-46db-e9f8-c4d17069be9e@oktetlabs.ru \
    --to=andrew.rybchenko@oktetlabs.ru \
    --cc=david.marchand@redhat.com \
    --cc=dev@dpdk.org \
    --cc=hkalra@marvell.com \
    --cc=quentin@armitage.org.uk \
    --cc=stable@dpdk.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).