From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 2D88045482; Mon, 17 Jun 2024 16:15:00 +0200 (CEST) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 1CA0F4066A; Mon, 17 Jun 2024 16:15:00 +0200 (CEST) Received: from m16.mail.163.com (m16.mail.163.com [117.135.210.5]) by mails.dpdk.org (Postfix) with ESMTP id 3166A402AC for ; Mon, 17 Jun 2024 05:35:50 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=163.com; s=s110527; h=From:Subject:Date:Message-ID:MIME-Version: Content-Type; bh=d07fhn6WGyTTw/cAGvOZ+cez5+NUPdq5C1cvEW6Zmvo=; b=IEhIRe3syE+Q48zzupgII6eidvrvjx1638gNWYgduX1dGoPPrRT7Y8oo6YPYXa rf00fRh7QR3mBZ0lRy+GMHglxcU/2dCSTkHC7zun419EsFhOlkngVnd++FZAtvTo l2lTmB2FwNfhBhBtonmF6uq7uAAjw1fOCSJ1Z+ss4KE9c= Received: from localhost.localdomain (unknown [115.193.35.154]) by gzga-smtp-mta-g2-1 (Coremail) with SMTP id _____wD3XyMPr29mNxWbBA--.46772S2; Mon, 17 Jun 2024 11:35:44 +0800 (CST) From: zhaoxinxin <15957197901@163.com> To: dev@dpdk.org Cc: zhaoxinxin <15957197901@163.com> Subject: [PATCH] vhost: Fix the crash caused by accessing the released memory Date: Mon, 17 Jun 2024 11:35:39 +0800 Message-ID: <20240617033539.36949-1-15957197901@163.com> X-Mailer: git-send-email 2.45.2 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-CM-TRANSID: _____wD3XyMPr29mNxWbBA--.46772S2 X-Coremail-Antispam: 1Uf129KBjvdXoWruw4DGrWUZrWkXFy5Kw43Awb_yoWDKrb_uF 10vFy8Xa1DWrZIga43Cr1Yqr4Skw4xtFnYqF40yryrG348K3s09as2yF93AF17ur4fZr1U Arn5GFs3ur1IgjkaLaAFLSUrUUUUjb8apTn2vfkv8UJUUUU8Yxn0WfASr-VFAUDa7-sFnT 9fnUUvcSsGvfC2KfnxnUUI43ZEXa7sRR75r5UUUUU== X-Originating-IP: [115.193.35.154] X-CM-SenderInfo: zprvmkyxrzlmmqrbiqqrwthudrp/1tbiZQKaxF8ZYwa4vgABsd X-Mailman-Approved-At: Mon, 17 Jun 2024 16:14:58 +0200 X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org The rte_vhost_driver_unregister() 、vhost_user_read_cb()、vhost_user_client_reconnect() can be called at the same time by 3 threads. when memory of vsocket is freed in rte_vhost_driver_unregister(), then vhost_user_read_cb() maybe add vsocket to reconn_list, the invalid memory of vsocket is accessed in vhost_user_client_reconnect(). The core trace is: Program terminated with signal 11, Segmentation fault. The fix is to perform a delete operation again after releasing the memory Signed-off-by: zhaoxinxin <15957197901@163.com> --- lib/vhost/socket.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/lib/vhost/socket.c b/lib/vhost/socket.c index a75728a2e4..01946096c4 100644 --- a/lib/vhost/socket.c +++ b/lib/vhost/socket.c @@ -1121,6 +1121,8 @@ rte_vhost_driver_unregister(const char *path) if (vsocket->is_server) { close(vsocket->socket_fd); unlink(path); + } else if (vsocket->reconnect) { + vhost_user_remove_reconnect(vsocket); } pthread_mutex_destroy(&vsocket->conn_mutex); -- 2.45.2