From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id B8D0F454AC; Wed, 19 Jun 2024 17:57:03 +0200 (CEST) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 94355402D3; Wed, 19 Jun 2024 17:57:03 +0200 (CEST) Received: from m16.mail.163.com (m16.mail.163.com [117.135.210.5]) by mails.dpdk.org (Postfix) with ESMTP id AFDF24021D for ; Wed, 19 Jun 2024 14:27:48 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=163.com; s=s110527; h=From:Subject:Date:Message-ID:MIME-Version; bh=q17Sp dUsGW1hNtUU18sxYjBAlPqDFQGQ55mKY+CHn18=; b=jFC6tjx+mHQHiY1JK98dk Hi+f/Lj3N9/a/TBkpE23YbEr7zZr2F9b84IU3UlLnElRQhgpYhd9GI0NOouvaJWL X4G/QJoiF747W16QtVBa7mvPIXwPog/kLZJK0JUfI5ogr4PqqF8IdHHV/ZskG4qr mFE+T7MqFaMGZVn55yCXIg= Received: from localhost.localdomain (unknown [183.156.240.69]) by gzga-smtp-mta-g1-1 (Coremail) with SMTP id _____wDnF+XAznJmjYHpBA--.18347S2; Wed, 19 Jun 2024 20:27:45 +0800 (CST) From: zhaoxinxin <15957197901@163.com> To: dev@dpdk.org Cc: zhaoxinxin <15957197901@163.com> Subject: [PATCH] vhost: Fix the crash caused by accessing the released memory Date: Wed, 19 Jun 2024 20:27:39 +0800 Message-ID: <20240619122739.42573-1-15957197901@163.com> X-Mailer: git-send-email 2.45.2 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-CM-TRANSID: _____wDnF+XAznJmjYHpBA--.18347S2 X-Coremail-Antispam: 1Uf129KBjvdXoWrur4fZw1kGrW5Zw43Xw4kCrg_yoWDtFg_ur 10vFy8Xa1DWrZIga47Cr1jqr4Skw4xtF1FqF40yryrG348K3s09as2yF93AF17ur4fZr1U Crn5CFs3Zr1IgjkaLaAFLSUrUUUUjb8apTn2vfkv8UJUUUU8Yxn0WfASr-VFAUDa7-sFnT 9fnUUvcSsGvfC2KfnxnUUI43ZEXa7sRRlks3UUUUU== X-Originating-IP: [183.156.240.69] X-CM-SenderInfo: zprvmkyxrzlmmqrbiqqrwthudrp/xtbBcgEDxGWXvsU0FwAAse X-Mailman-Approved-At: Wed, 19 Jun 2024 17:57:02 +0200 X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org The rte_vhost_driver_unregister() vhost_user_read_cb() vhost_user_client_reconnect() can be called at the same time by 3 threads. when memory of vsocket is freed in rte_vhost_driver_unregister(), then vhost_user_read_cb() maybe add vsocket to reconn_list, the invalid memory of vsocket is accessed in vhost_user_client_reconnect(). The core trace is: Program terminated with signal 11, Segmentation fault. The fix is to perform a delete operation again after releasing the memory Signed-off-by: zhaoxinxin <15957197901@163.com> --- lib/vhost/socket.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/lib/vhost/socket.c b/lib/vhost/socket.c index a75728a2e4..01946096c4 100644 --- a/lib/vhost/socket.c +++ b/lib/vhost/socket.c @@ -1121,6 +1121,8 @@ rte_vhost_driver_unregister(const char *path) if (vsocket->is_server) { close(vsocket->socket_fd); unlink(path); + } else if (vsocket->reconnect) { + vhost_user_remove_reconnect(vsocket); } pthread_mutex_destroy(&vsocket->conn_mutex); -- 2.45.2