From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id ABF58454A7; Wed, 19 Jun 2024 10:43:14 +0200 (CEST) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 982144026C; Wed, 19 Jun 2024 10:43:14 +0200 (CEST) Received: from m16.mail.163.com (m16.mail.163.com [117.135.210.2]) by mails.dpdk.org (Postfix) with ESMTP id 4B98C4021D for ; Wed, 19 Jun 2024 10:40:00 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=163.com; s=s110527; h=From:Subject:Date:Message-ID:MIME-Version; bh=LBRu6 hg5I55TcPWdfU7OdlQX6t6s/zSA1OyeRN7ghG4=; b=HAAc/pE6iI5NxKaAoUZY6 Zdxj6HVe6c6Jtq9FtHF9eCY7aC/1Xgq0ZBPYDHzClrwVHRg06E6lb3BMCeXgucG6 trK9jKlpIJWakzOA5nQcu/GboXsJI9uiT618LXIOKhu94jd1+2UJ5U8u2fOam8tO aG4nfYYAiBuoCg2vY4UeHA= Received: from localhost.localdomain (unknown [183.156.240.69]) by gzga-smtp-mta-g2-3 (Coremail) with SMTP id _____wD3H41XmXJmZWSuEQ--.6904S2; Wed, 19 Jun 2024 16:39:52 +0800 (CST) From: zhaoxinxin <15957197901@163.com> To: dev@dpdk.org Cc: zhaoxinxin <15957197901@163.com> Subject: [PATCH] vhost: Fix the crash caused by accessing the released memory Date: Wed, 19 Jun 2024 16:39:49 +0800 Message-ID: <20240619083949.72621-1-15957197901@163.com> X-Mailer: git-send-email 2.45.2 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-CM-TRANSID: _____wD3H41XmXJmZWSuEQ--.6904S2 X-Coremail-Antispam: 1Uf129KBjvdXoWrur4fZw1kGrW5Zw43Xw4kCrg_yoWDtFg_ur 10vFy8Xa1DWrZIga47Cr1jqr4Skw4xtF1FqF40yryrG348K3s09as2yF93AF17ur4fZr1U Crn5CFs3Zr1IgjkaLaAFLSUrUUUUjb8apTn2vfkv8UJUUUU8Yxn0WfASr-VFAUDa7-sFnT 9fnUUvcSsGvfC2KfnxnUUI43ZEXa7sRRlks3UUUUU== X-Originating-IP: [183.156.240.69] X-CM-SenderInfo: zprvmkyxrzlmmqrbiqqrwthudrp/xtbBch0DxGWXvsFEKQAAsI X-Mailman-Approved-At: Wed, 19 Jun 2024 10:43:13 +0200 X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org The rte_vhost_driver_unregister() vhost_user_read_cb() vhost_user_client_reconnect() can be called at the same time by 3 threads. when memory of vsocket is freed in rte_vhost_driver_unregister(), then vhost_user_read_cb() maybe add vsocket to reconn_list, the invalid memory of vsocket is accessed in vhost_user_client_reconnect(). The core trace is: Program terminated with signal 11, Segmentation fault. The fix is to perform a delete operation again after releasing the memory Signed-off-by: zhaoxinxin <15957197901@163.com> --- lib/vhost/socket.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/lib/vhost/socket.c b/lib/vhost/socket.c index a75728a2e4..01946096c4 100644 --- a/lib/vhost/socket.c +++ b/lib/vhost/socket.c @@ -1121,6 +1121,8 @@ rte_vhost_driver_unregister(const char *path) if (vsocket->is_server) { close(vsocket->socket_fd); unlink(path); + } else if (vsocket->reconnect) { + vhost_user_remove_reconnect(vsocket); } pthread_mutex_destroy(&vsocket->conn_mutex); -- 2.45.2