From mboxrd@z Thu Jan 1 00:00:00 1970
Return-Path: <dev-bounces@dpdk.org>
Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124])
by inbox.dpdk.org (Postfix) with ESMTP id 1F11CA0A0E;
Wed, 7 Apr 2021 14:54:53 +0200 (CEST)
Received: from [217.70.189.124] (localhost [127.0.0.1])
by mails.dpdk.org (Postfix) with ESMTP id 06081406A3;
Wed, 7 Apr 2021 14:54:53 +0200 (CEST)
Received: from mail-qt1-f171.google.com (mail-qt1-f171.google.com
[209.85.160.171])
by mails.dpdk.org (Postfix) with ESMTP id 7249B4013F;
Wed, 7 Apr 2021 14:54:51 +0200 (CEST)
Received: by mail-qt1-f171.google.com with SMTP id y2so13588896qtw.13;
Wed, 07 Apr 2021 05:54:51 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025;
h=from:to:cc:subject:date:message-id:in-reply-to:references
:mime-version:content-transfer-encoding;
bh=VBELle91l8i5+E/60sPUdUFl21WDeMBz/Ys9FqGQvss=;
b=KAqNx6p+XXhcnaahd2/Qext0wiAUvFpqaqYhnAt2ziDeGrLX0CDmjp+KSONBSGmATw
3AhhTbRI+bKYpR3QDP6hdmdn0HI9GtYrOiSVcrYWfNJtFLRXAzv+CQamlwPgG0WInWbQ
eP+iUYWKvM3lzJ/BjiWAhts2g5KYL3zzIcKKc69ReK8TIJuOvUx/oC8690n7KoIhVO8d
TjR7w+z3mRyDyR/CRQopafMWV6DfiS11DRBTaYSblailod1TnTaPlMzg8ist64e0kDyn
sboAJDw7jV5lwU6X8Gg+hi+JIAvAFaN17ai9uqVoGYGHDO22yYA8u2fcnuEifuAEYgv9
+p2Q==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20161025;
h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to
:references:mime-version:content-transfer-encoding;
bh=VBELle91l8i5+E/60sPUdUFl21WDeMBz/Ys9FqGQvss=;
b=apBCAx5nI2w3Uu/o1YY/sLI8YcfyA3d1WfEZJi4CxrR+7I9Qjeu1KGAxifKWM1Arjc
PdyzcSZ1j2MbRyZSpC6vkTi23ChPpo0RgKFOS9qU4EjFsm81zfeRQLg/3k/DoRv8QnVj
GatbEBq43l/soLTuJEJTgb84+aC7t/C17Ppph7T/3GkEtORrb6GCjuUHyPwNv75J90th
fWQiGaR8ca9mlvKmsPywY67WTtux2Pmlglx8IktPcZkQoFoBxCm+hqm880naFvSF6n0x
P5NpE0JUe0vVBg2/LHtt/gMb/1nHpEVFNtZZN05Lm7iWzGnd4RRUwb/MBLJIo5rwg6ff
iC0w==
X-Gm-Message-State: AOAM533WuGTkaBbELoYdjL3fnFqNb5OjVMekXJLl1+5V0GRxbsJ+mME5
bVoG4rZvxNAXCbTcMvUP9VM=
X-Google-Smtp-Source: ABdhPJxNe6wBCy6/ssWc1NPWwFWSAY0+/D3s22zPoumo3ULAH/0g0d+mQUVeqqFHXO9W2xgIyV1ePA==
X-Received: by 2002:ac8:6e85:: with SMTP id c5mr2498688qtv.299.1617800090914;
Wed, 07 Apr 2021 05:54:50 -0700 (PDT)
Received: from localhost.localdomain
(bras-base-hullpq2034w-grc-18-74-15-213-92.dsl.bell.ca. [74.15.213.92])
by smtp.gmail.com with ESMTPSA id w8sm1652028qts.43.2021.04.07.05.54.50
(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
Wed, 07 Apr 2021 05:54:50 -0700 (PDT)
From: Luc Pelletier <lucp.at.work@gmail.com>
To: olivier.matz@6wind.com, jianfeng.tan@intel.com,
Honnappa.Nagarahalli@arm.com
Cc: dev@dpdk.org,
Luc Pelletier <lucp.at.work@gmail.com>,
stable@dpdk.org
Date: Wed, 7 Apr 2021 08:53:23 -0400
Message-Id: <20210407125322.124327-1-lucp.at.work@gmail.com>
In-Reply-To: <20210407123529.123899-1-lucp.at.work@gmail.com>
References: <20210407123529.123899-1-lucp.at.work@gmail.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Subject: [dpdk-dev] [PATCH v5] eal: fix race in ctrl thread creation
X-BeenThere: dev@dpdk.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: DPDK patches and discussions <dev.dpdk.org>
List-Unsubscribe: <https://mails.dpdk.org/options/dev>,
<mailto:dev-request@dpdk.org?subject=unsubscribe>
List-Archive: <http://mails.dpdk.org/archives/dev/>
List-Post: <mailto:dev@dpdk.org>
List-Help: <mailto:dev-request@dpdk.org?subject=help>
List-Subscribe: <https://mails.dpdk.org/listinfo/dev>,
<mailto:dev-request@dpdk.org?subject=subscribe>
Errors-To: dev-bounces@dpdk.org
Sender: "dev" <dev-bounces@dpdk.org>
The creation of control threads uses a pthread barrier for
synchronization. This patch fixes a race condition where the pthread
barrier could get destroyed while one of the threads has not yet
returned from the pthread_barrier_wait function, which could result in
undefined behaviour.
Fixes: 3a0d465d4c53 ("eal: fix use-after-free on control thread creation")
Cc: jianfeng.tan@intel.com
Cc: stable@dpdk.org
Signed-off-by: Luc Pelletier <lucp.at.work@gmail.com>
---
Same as v4 except that I fixed 2 minor style issues flagged by patchwork.
lib/librte_eal/common/eal_common_thread.c | 52 +++++++++++------------
1 file changed, 25 insertions(+), 27 deletions(-)
diff --git a/lib/librte_eal/common/eal_common_thread.c b/lib/librte_eal/common/eal_common_thread.c
index 73a055902..c1044e795 100644
--- a/lib/librte_eal/common/eal_common_thread.c
+++ b/lib/librte_eal/common/eal_common_thread.c
@@ -170,11 +170,19 @@ struct rte_thread_ctrl_params {
void *(*start_routine)(void *);
void *arg;
pthread_barrier_t configured;
+ unsigned int refcnt;
};
+static void ctrl_params_free(struct rte_thread_ctrl_params *params)
+{
+ if (__atomic_sub_fetch(¶ms->refcnt, 1, __ATOMIC_ACQ_REL) == 0) {
+ pthread_barrier_destroy(¶ms->configured);
+ free(params);
+ }
+}
+
static void *ctrl_thread_init(void *arg)
{
- int ret;
struct internal_config *internal_conf =
eal_get_internal_configuration();
rte_cpuset_t *cpuset = &internal_conf->ctrl_cpuset;
@@ -184,11 +192,8 @@ static void *ctrl_thread_init(void *arg)
__rte_thread_init(rte_lcore_id(), cpuset);
- ret = pthread_barrier_wait(¶ms->configured);
- if (ret == PTHREAD_BARRIER_SERIAL_THREAD) {
- pthread_barrier_destroy(¶ms->configured);
- free(params);
- }
+ pthread_barrier_wait(¶ms->configured);
+ ctrl_params_free(params);
return start_routine(routine_arg);
}
@@ -210,14 +215,15 @@ rte_ctrl_thread_create(pthread_t *thread, const char *name,
params->start_routine = start_routine;
params->arg = arg;
+ params->refcnt = 2;
- pthread_barrier_init(¶ms->configured, NULL, 2);
+ ret = pthread_barrier_init(¶ms->configured, NULL, 2);
+ if (ret != 0)
+ goto fail_no_barrier;
ret = pthread_create(thread, attr, ctrl_thread_init, (void *)params);
- if (ret != 0) {
- free(params);
- return -ret;
- }
+ if (ret != 0)
+ goto fail_with_barrier;
if (name != NULL) {
ret = rte_thread_setname(*thread, name);
@@ -227,25 +233,17 @@ rte_ctrl_thread_create(pthread_t *thread, const char *name,
}
ret = pthread_setaffinity_np(*thread, sizeof(*cpuset), cpuset);
- if (ret)
- goto fail;
+ pthread_barrier_wait(¶ms->configured);
+ ctrl_params_free(params);
- ret = pthread_barrier_wait(¶ms->configured);
- if (ret == PTHREAD_BARRIER_SERIAL_THREAD) {
- pthread_barrier_destroy(¶ms->configured);
- free(params);
- }
+ return -ret;
- return 0;
+fail_with_barrier:
+ pthread_barrier_destroy(¶ms->configured);
+
+fail_no_barrier:
+ free(params);
-fail:
- if (PTHREAD_BARRIER_SERIAL_THREAD ==
- pthread_barrier_wait(¶ms->configured)) {
- pthread_barrier_destroy(¶ms->configured);
- free(params);
- }
- pthread_cancel(*thread);
- pthread_join(*thread, NULL);
return -ret;
}
--
2.25.1