From: David Marchand <david.marchand@redhat.com>
To: dev@dpdk.org
Cc: yanx.xia@intel.com, Hyong Youb Kim <hyonkim@cisco.com>,
Harman Kalra <hkalra@marvell.com>
Subject: [dpdk-dev] [PATCH] bus/pci: fix use after free on unplug
Date: Wed, 3 Nov 2021 12:16:15 +0100 [thread overview]
Message-ID: <20211103111615.6271-1-david.marchand@redhat.com> (raw)
rte_pci_unmap_device() needs intr_handle objects to unregister
callbacks.
Bugzilla ID: 845
Fixes: d61138d4f0e2 ("drivers: remove direct access to interrupt handle")
Signed-off-by: David Marchand <david.marchand@redhat.com>
---
drivers/bus/pci/pci_common.c | 17 +++++++++--------
1 file changed, 9 insertions(+), 8 deletions(-)
diff --git a/drivers/bus/pci/pci_common.c b/drivers/bus/pci/pci_common.c
index f8fff2c98e..4a3a87f24f 100644
--- a/drivers/bus/pci/pci_common.c
+++ b/drivers/bus/pci/pci_common.c
@@ -271,10 +271,6 @@ rte_pci_probe_one_driver(struct rte_pci_driver *dr,
return ret; /* no rollback if already succeeded earlier */
if (ret) {
dev->driver = NULL;
- rte_intr_instance_free(dev->vfio_req_intr_handle);
- dev->vfio_req_intr_handle = NULL;
- rte_intr_instance_free(dev->intr_handle);
- dev->intr_handle = NULL;
if ((dr->drv_flags & RTE_PCI_DRV_NEED_MAPPING) &&
/* Don't unmap if device is unsupported and
* driver needs mapped resources.
@@ -282,6 +278,10 @@ rte_pci_probe_one_driver(struct rte_pci_driver *dr,
!(ret > 0 &&
(dr->drv_flags & RTE_PCI_DRV_KEEP_MAPPED_RES)))
rte_pci_unmap_device(dev);
+ rte_intr_instance_free(dev->vfio_req_intr_handle);
+ dev->vfio_req_intr_handle = NULL;
+ rte_intr_instance_free(dev->intr_handle);
+ dev->intr_handle = NULL;
} else {
dev->device.driver = &dr->driver;
}
@@ -322,15 +322,16 @@ rte_pci_detach_dev(struct rte_pci_device *dev)
/* clear driver structure */
dev->driver = NULL;
dev->device.driver = NULL;
- rte_intr_instance_free(dev->intr_handle);
- dev->intr_handle = NULL;
- rte_intr_instance_free(dev->vfio_req_intr_handle);
- dev->vfio_req_intr_handle = NULL;
if (dr->drv_flags & RTE_PCI_DRV_NEED_MAPPING)
/* unmap resources for devices that use igb_uio */
rte_pci_unmap_device(dev);
+ rte_intr_instance_free(dev->intr_handle);
+ dev->intr_handle = NULL;
+ rte_intr_instance_free(dev->vfio_req_intr_handle);
+ dev->vfio_req_intr_handle = NULL;
+
return 0;
}
--
2.23.0
next reply other threads:[~2021-11-03 11:17 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-11-03 11:16 David Marchand [this message]
2021-11-04 14:15 ` Maxime Coquelin
2021-11-04 14:21 ` David Marchand
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20211103111615.6271-1-david.marchand@redhat.com \
--to=david.marchand@redhat.com \
--cc=dev@dpdk.org \
--cc=hkalra@marvell.com \
--cc=hyonkim@cisco.com \
--cc=yanx.xia@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).