From: Raslan Darawsheh <rasland@nvidia.com>
To: Yunjian Wang <wangyunjian@huawei.com>, "dev@dpdk.org" <dev@dpdk.org>
Cc: Dariusz Sosnowski <dsosnowski@nvidia.com>,
Ori Kam <orika@nvidia.com>, Matan Azrad <matan@nvidia.com>,
Slava Ovsiienko <viacheslavo@nvidia.com>,
Suanming Mou <suanmingm@nvidia.com>,
"luyicai@huawei.com" <luyicai@huawei.com>,
Pengfei Sun <sunpengfei16@huawei.com>,
"stable@dpdk.org" <stable@dpdk.org>
Subject: RE: [PATCH] net/mlx5: fix use after free when releasing tx queues
Date: Tue, 27 Feb 2024 16:15:49 +0000 [thread overview]
Message-ID: <MN0PR12MB6056C9FB3E1644A4BFD9F6D6CF592@MN0PR12MB6056.namprd12.prod.outlook.com> (raw)
In-Reply-To: <1708421499-42236-1-git-send-email-wangyunjian@huawei.com>
Hi,
> -----Original Message-----
> From: Yunjian Wang <wangyunjian@huawei.com>
> Sent: Tuesday, February 20, 2024 11:32 AM
> To: dev@dpdk.org
> Cc: Dariusz Sosnowski <dsosnowski@nvidia.com>; Ori Kam
> <orika@nvidia.com>; Matan Azrad <matan@nvidia.com>; Slava Ovsiienko
> <viacheslavo@nvidia.com>; Suanming Mou <suanmingm@nvidia.com>;
> luyicai@huawei.com; Pengfei Sun <sunpengfei16@huawei.com>;
> stable@dpdk.org
> Subject: [PATCH] net/mlx5: fix use after free when releasing tx queues
>
> From: Pengfei Sun <sunpengfei16@huawei.com>
>
> In function mlx5_dev_configure, dev->data->tx_queues is assigned to priv-
> >txqs. When a member is removed from a bond, the function
> eth_dev_tx_queue_config is called to release dev->data->tx_queues.
> However, function mlx5_dev_close will access priv->txqs again and cause the
> use after free problem.
>
> In function mlx5_dev_close, before free priv->txqs, we add a check that dev-
> >data->tx_queues is not NULL.
>
> build/app/dpdk-testpmd -c7 -a 0000:08:00.2 -- -i --nb-cores=2
> --total-num-mbufs=2048
>
> testpmd> port stop 0
> testpmd> create bonding device 4 0
> testpmd> add bonding member 0 1
> testpmd> remove bonding member 0 1
> testpmd> quit
>
> ASan reports:
> ==2571911==ERROR: AddressSanitizer: heap-use-after-free on address
> 0x000174529880 at pc 0x0000113c8440 bp 0xffffefae0ea0 sp 0xffffefae0eb0
> READ of size 8 at 0x000174529880 thread T0
> #0 0x113c843c in mlx5_txq_release ../drivers/net/mlx5/mlx5_txq.c:
> 1203
> #1 0xffdb53c in mlx5_dev_close ../drivers/net/mlx5/mlx5.c:2286
> #2 0xe12dc0 in rte_eth_dev_close ../lib/ethdev/rte_ethdev.c:1877
> #3 0x6bac1c in close_port ../app/test-pmd/testpmd.c:3540
> #4 0x6bc320 in pmd_test_exit ../app/test-pmd/testpmd.c:3808
> #5 0x6c1a94 in main ../app/test-pmd/testpmd.c:4759
> #6 0xffff9328f038 (/usr/lib64/libc.so.6+0x2b038)
> #7 0xffff9328f110 in __libc_start_main (/usr/lib64/libc.so.6+
> 0x2b110)
>
> Fixes: 6e78005 ("net/mlx5: add reference counter on DPDK Tx queues")
> Cc: stable@dpdk.org
>
> Reported-by: Yunjian Wang <wangyunjian@huawei.com>
> Signed-off-by: Pengfei Sun <sunpengfei16@huawei.com>
Patch applied to next-net-mlx,
Kindest regards
Raslan Darawsheh
prev parent reply other threads:[~2024-02-27 16:15 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-02-20 9:31 Yunjian Wang
2024-02-20 13:55 ` Dariusz Sosnowski
2024-02-21 10:24 ` Thomas Monjalon
2024-02-27 16:15 ` Raslan Darawsheh [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=MN0PR12MB6056C9FB3E1644A4BFD9F6D6CF592@MN0PR12MB6056.namprd12.prod.outlook.com \
--to=rasland@nvidia.com \
--cc=dev@dpdk.org \
--cc=dsosnowski@nvidia.com \
--cc=luyicai@huawei.com \
--cc=matan@nvidia.com \
--cc=orika@nvidia.com \
--cc=stable@dpdk.org \
--cc=suanmingm@nvidia.com \
--cc=sunpengfei16@huawei.com \
--cc=viacheslavo@nvidia.com \
--cc=wangyunjian@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).