* [dpdk-dev] [PATCH] bus/pci: fix use after free on unplug
@ 2021-11-03 11:16 David Marchand
2021-11-04 14:15 ` Maxime Coquelin
0 siblings, 1 reply; 3+ messages in thread
From: David Marchand @ 2021-11-03 11:16 UTC (permalink / raw)
To: dev; +Cc: yanx.xia, Hyong Youb Kim, Harman Kalra
rte_pci_unmap_device() needs intr_handle objects to unregister
callbacks.
Bugzilla ID: 845
Fixes: d61138d4f0e2 ("drivers: remove direct access to interrupt handle")
Signed-off-by: David Marchand <david.marchand@redhat.com>
---
drivers/bus/pci/pci_common.c | 17 +++++++++--------
1 file changed, 9 insertions(+), 8 deletions(-)
diff --git a/drivers/bus/pci/pci_common.c b/drivers/bus/pci/pci_common.c
index f8fff2c98e..4a3a87f24f 100644
--- a/drivers/bus/pci/pci_common.c
+++ b/drivers/bus/pci/pci_common.c
@@ -271,10 +271,6 @@ rte_pci_probe_one_driver(struct rte_pci_driver *dr,
return ret; /* no rollback if already succeeded earlier */
if (ret) {
dev->driver = NULL;
- rte_intr_instance_free(dev->vfio_req_intr_handle);
- dev->vfio_req_intr_handle = NULL;
- rte_intr_instance_free(dev->intr_handle);
- dev->intr_handle = NULL;
if ((dr->drv_flags & RTE_PCI_DRV_NEED_MAPPING) &&
/* Don't unmap if device is unsupported and
* driver needs mapped resources.
@@ -282,6 +278,10 @@ rte_pci_probe_one_driver(struct rte_pci_driver *dr,
!(ret > 0 &&
(dr->drv_flags & RTE_PCI_DRV_KEEP_MAPPED_RES)))
rte_pci_unmap_device(dev);
+ rte_intr_instance_free(dev->vfio_req_intr_handle);
+ dev->vfio_req_intr_handle = NULL;
+ rte_intr_instance_free(dev->intr_handle);
+ dev->intr_handle = NULL;
} else {
dev->device.driver = &dr->driver;
}
@@ -322,15 +322,16 @@ rte_pci_detach_dev(struct rte_pci_device *dev)
/* clear driver structure */
dev->driver = NULL;
dev->device.driver = NULL;
- rte_intr_instance_free(dev->intr_handle);
- dev->intr_handle = NULL;
- rte_intr_instance_free(dev->vfio_req_intr_handle);
- dev->vfio_req_intr_handle = NULL;
if (dr->drv_flags & RTE_PCI_DRV_NEED_MAPPING)
/* unmap resources for devices that use igb_uio */
rte_pci_unmap_device(dev);
+ rte_intr_instance_free(dev->intr_handle);
+ dev->intr_handle = NULL;
+ rte_intr_instance_free(dev->vfio_req_intr_handle);
+ dev->vfio_req_intr_handle = NULL;
+
return 0;
}
--
2.23.0
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [dpdk-dev] [PATCH] bus/pci: fix use after free on unplug
2021-11-03 11:16 [dpdk-dev] [PATCH] bus/pci: fix use after free on unplug David Marchand
@ 2021-11-04 14:15 ` Maxime Coquelin
2021-11-04 14:21 ` David Marchand
0 siblings, 1 reply; 3+ messages in thread
From: Maxime Coquelin @ 2021-11-04 14:15 UTC (permalink / raw)
To: David Marchand, dev; +Cc: yanx.xia, Hyong Youb Kim, Harman Kalra
On 11/3/21 12:16, David Marchand wrote:
> rte_pci_unmap_device() needs intr_handle objects to unregister
> callbacks.
>
> Bugzilla ID: 845
> Fixes: d61138d4f0e2 ("drivers: remove direct access to interrupt handle")
>
> Signed-off-by: David Marchand <david.marchand@redhat.com>
> ---
> drivers/bus/pci/pci_common.c | 17 +++++++++--------
> 1 file changed, 9 insertions(+), 8 deletions(-)
>
> diff --git a/drivers/bus/pci/pci_common.c b/drivers/bus/pci/pci_common.c
> index f8fff2c98e..4a3a87f24f 100644
> --- a/drivers/bus/pci/pci_common.c
> +++ b/drivers/bus/pci/pci_common.c
> @@ -271,10 +271,6 @@ rte_pci_probe_one_driver(struct rte_pci_driver *dr,
> return ret; /* no rollback if already succeeded earlier */
> if (ret) {
> dev->driver = NULL;
> - rte_intr_instance_free(dev->vfio_req_intr_handle);
> - dev->vfio_req_intr_handle = NULL;
> - rte_intr_instance_free(dev->intr_handle);
> - dev->intr_handle = NULL;
> if ((dr->drv_flags & RTE_PCI_DRV_NEED_MAPPING) &&
> /* Don't unmap if device is unsupported and
> * driver needs mapped resources.
> @@ -282,6 +278,10 @@ rte_pci_probe_one_driver(struct rte_pci_driver *dr,
> !(ret > 0 &&
> (dr->drv_flags & RTE_PCI_DRV_KEEP_MAPPED_RES)))
> rte_pci_unmap_device(dev);
> + rte_intr_instance_free(dev->vfio_req_intr_handle);
> + dev->vfio_req_intr_handle = NULL;
> + rte_intr_instance_free(dev->intr_handle);
> + dev->intr_handle = NULL;
> } else {
> dev->device.driver = &dr->driver;
> }
> @@ -322,15 +322,16 @@ rte_pci_detach_dev(struct rte_pci_device *dev)
> /* clear driver structure */
> dev->driver = NULL;
> dev->device.driver = NULL;
> - rte_intr_instance_free(dev->intr_handle);
> - dev->intr_handle = NULL;
> - rte_intr_instance_free(dev->vfio_req_intr_handle);
> - dev->vfio_req_intr_handle = NULL;
>
> if (dr->drv_flags & RTE_PCI_DRV_NEED_MAPPING)
> /* unmap resources for devices that use igb_uio */
> rte_pci_unmap_device(dev);
>
> + rte_intr_instance_free(dev->intr_handle);
> + dev->intr_handle = NULL;
> + rte_intr_instance_free(dev->vfio_req_intr_handle);
> + dev->vfio_req_intr_handle = NULL;
> +
> return 0;
> }
>
>
Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>
Thanks,
Maxime
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [dpdk-dev] [PATCH] bus/pci: fix use after free on unplug
2021-11-04 14:15 ` Maxime Coquelin
@ 2021-11-04 14:21 ` David Marchand
0 siblings, 0 replies; 3+ messages in thread
From: David Marchand @ 2021-11-04 14:21 UTC (permalink / raw)
To: David Marchand
Cc: dev, Maxime Coquelin, Yan Xia, Hyong Youb Kim, Harman Kalra
On Thu, Nov 4, 2021 at 3:16 PM Maxime Coquelin
<maxime.coquelin@redhat.com> wrote:
> On 11/3/21 12:16, David Marchand wrote:
> > rte_pci_unmap_device() needs intr_handle objects to unregister
> > callbacks.
> >
> > Bugzilla ID: 845
> > Fixes: d61138d4f0e2 ("drivers: remove direct access to interrupt handle")
> >
> > Signed-off-by: David Marchand <david.marchand@redhat.com>
Tested-by: Yan Xia <yanx.xia@intel.com>
> Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>
Applied, thanks.
--
David Marchand
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-11-04 14:21 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-11-03 11:16 [dpdk-dev] [PATCH] bus/pci: fix use after free on unplug David Marchand
2021-11-04 14:15 ` Maxime Coquelin
2021-11-04 14:21 ` David Marchand
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).