* [PATCH dpdk] graph: fix use-after-free when updating edges with active graphs
@ 2025-10-31 22:13 Robin Jarry
2025-11-10 8:50 ` Jerin Jacob
0 siblings, 1 reply; 3+ messages in thread
From: Robin Jarry @ 2025-10-31 22:13 UTC (permalink / raw)
To: dev, Jerin Jacob, Kiran Kumar K, Nithin Dabilpuram, Zhirun Yan,
Pavan Nikhilesh
Cc: stable
After creating at least one graph and calling rte_node_edge_update to
add a new edge on a node which is in use in the graph, the node memory
is reallocated but the active graph still has a pointer to the freed
memory.
When destroying the graph, it causes a use-after-free error detected by
libasan:
ERROR: AddressSanitizer: heap-use-after-free
READ of size 8 at 0x7c4baa5e4da8 thread T0
#0 0x0000005ad224 in graph_node_fini lib/graph/graph.c:256
#1 0x0000005ae657 in rte_graph_destroy lib/graph/graph.c:504
...
freed by thread T0 here:
#0 0x7f1bac4e5e4b in realloc.part.0 (/lib64/libasan.so.8+0xe5e4b)
#1 0x0000005ab6d7 in edge_update lib/graph/node.c:271
#2 0x0000005abb1b in rte_node_edge_update lib/graph/node.c:339
...
previously allocated by thread T0 here:
#0 0x7f1bac4e5e4b in realloc.part.0 (/lib64/libasan.so.8+0xe5e4b)
#1 0x0000005ab6d7 in edge_update lib/graph/node.c:271
#2 0x0000005abb1b in rte_node_edge_update lib/graph/node.c:339
...
Use malloc+memcpy and add an internal function to replace all references
to the old node memory before freeing it.
Cc: stable@dpdk.org
Fixes: c59dac2ca14a ("graph: implement node operations")
Signed-off-by: Robin Jarry <rjarry@redhat.com>
---
lib/graph/graph.c | 14 ++++++++++++++
lib/graph/graph_private.h | 12 ++++++++++++
lib/graph/node.c | 6 +++++-
3 files changed, 31 insertions(+), 1 deletion(-)
diff --git a/lib/graph/graph.c b/lib/graph/graph.c
index 61159edc7261..6911ea8abeed 100644
--- a/lib/graph/graph.c
+++ b/lib/graph/graph.c
@@ -277,6 +277,20 @@ graph_node_fini(struct graph *graph)
graph_node->node->name));
}
+void
+graph_node_replace_all(struct node *old, struct node *new)
+{
+ struct graph_node *graph_node;
+ struct graph *graph;
+
+ STAILQ_FOREACH(graph, &graph_list, next) {
+ STAILQ_FOREACH(graph_node, &graph->node_list, next) {
+ if (graph_node->node == old)
+ graph_node->node = new;
+ }
+ }
+}
+
static struct rte_graph *
graph_mem_fixup_node_ctx(struct rte_graph *graph)
{
diff --git a/lib/graph/graph_private.h b/lib/graph/graph_private.h
index 21912c0ae63f..26cdc6637192 100644
--- a/lib/graph/graph_private.h
+++ b/lib/graph/graph_private.h
@@ -299,6 +299,18 @@ int graph_node_has_edge_to_src_node(struct graph *graph);
*/
int graph_node_has_loop_edge(struct graph *graph);
+/**
+ * @internal
+ *
+ * Replace all pointers of a given node with another one in all active graphs.
+ *
+ * @param old
+ * Node pointer to replace in all graphs.
+ * @param new
+ * Updated pointer.
+ */
+void graph_node_replace_all(struct node *old, struct node *new);
+
/**
* @internal
*
diff --git a/lib/graph/node.c b/lib/graph/node.c
index cae1c809edc4..e3359fe490a5 100644
--- a/lib/graph/node.c
+++ b/lib/graph/node.c
@@ -325,11 +325,15 @@ edge_update(struct node *node, struct node *prev, rte_edge_t from,
need_realloc = max_edges > node->nb_edges;
if (need_realloc) {
sz = sizeof(struct node) + (max_edges * RTE_NODE_NAMESIZE);
- new_node = realloc(node, sz);
+ new_node = malloc(sz);
if (new_node == NULL) {
rte_errno = ENOMEM;
goto restore;
} else {
+ sz = sizeof(*node) + (node->nb_edges * RTE_NODE_NAMESIZE);
+ memcpy(new_node, node, sz);
+ graph_node_replace_all(node, new_node);
+ free(node);
node = new_node;
}
}
--
2.51.1
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH dpdk] graph: fix use-after-free when updating edges with active graphs
2025-10-31 22:13 [PATCH dpdk] graph: fix use-after-free when updating edges with active graphs Robin Jarry
@ 2025-11-10 8:50 ` Jerin Jacob
2025-11-11 14:19 ` Thomas Monjalon
0 siblings, 1 reply; 3+ messages in thread
From: Jerin Jacob @ 2025-11-10 8:50 UTC (permalink / raw)
To: Robin Jarry
Cc: dev, Jerin Jacob, Kiran Kumar K, Nithin Dabilpuram, Zhirun Yan,
Pavan Nikhilesh, stable
On Sat, Nov 1, 2025 at 3:43 AM Robin Jarry <rjarry@redhat.com> wrote:
>
> After creating at least one graph and calling rte_node_edge_update to
> add a new edge on a node which is in use in the graph, the node memory
> is reallocated but the active graph still has a pointer to the freed
> memory.
>
> When destroying the graph, it causes a use-after-free error detected by
> libasan:
>
> ERROR: AddressSanitizer: heap-use-after-free
> READ of size 8 at 0x7c4baa5e4da8 thread T0
> #0 0x0000005ad224 in graph_node_fini lib/graph/graph.c:256
> #1 0x0000005ae657 in rte_graph_destroy lib/graph/graph.c:504
> ...
>
> freed by thread T0 here:
> #0 0x7f1bac4e5e4b in realloc.part.0 (/lib64/libasan.so.8+0xe5e4b)
> #1 0x0000005ab6d7 in edge_update lib/graph/node.c:271
> #2 0x0000005abb1b in rte_node_edge_update lib/graph/node.c:339
> ...
>
> previously allocated by thread T0 here:
> #0 0x7f1bac4e5e4b in realloc.part.0 (/lib64/libasan.so.8+0xe5e4b)
> #1 0x0000005ab6d7 in edge_update lib/graph/node.c:271
> #2 0x0000005abb1b in rte_node_edge_update lib/graph/node.c:339
> ...
>
> Use malloc+memcpy and add an internal function to replace all references
> to the old node memory before freeing it.
>
> Cc: stable@dpdk.org
> Fixes: c59dac2ca14a ("graph: implement node operations")
Acked-by: Jerin Jacob <jerinj@marvell.com>
>
> Signed-off-by: Robin Jarry <rjarry@redhat.com>
> ---
> lib/graph/graph.c | 14 ++++++++++++++
> lib/graph/graph_private.h | 12 ++++++++++++
> lib/graph/node.c | 6 +++++-
> 3 files changed, 31 insertions(+), 1 deletion(-)
>
> diff --git a/lib/graph/graph.c b/lib/graph/graph.c
> index 61159edc7261..6911ea8abeed 100644
> --- a/lib/graph/graph.c
> +++ b/lib/graph/graph.c
> @@ -277,6 +277,20 @@ graph_node_fini(struct graph *graph)
> graph_node->node->name));
> }
>
> +void
> +graph_node_replace_all(struct node *old, struct node *new)
> +{
> + struct graph_node *graph_node;
> + struct graph *graph;
> +
> + STAILQ_FOREACH(graph, &graph_list, next) {
> + STAILQ_FOREACH(graph_node, &graph->node_list, next) {
> + if (graph_node->node == old)
> + graph_node->node = new;
> + }
> + }
> +}
> +
> static struct rte_graph *
> graph_mem_fixup_node_ctx(struct rte_graph *graph)
> {
> diff --git a/lib/graph/graph_private.h b/lib/graph/graph_private.h
> index 21912c0ae63f..26cdc6637192 100644
> --- a/lib/graph/graph_private.h
> +++ b/lib/graph/graph_private.h
> @@ -299,6 +299,18 @@ int graph_node_has_edge_to_src_node(struct graph *graph);
> */
> int graph_node_has_loop_edge(struct graph *graph);
>
> +/**
> + * @internal
> + *
> + * Replace all pointers of a given node with another one in all active graphs.
> + *
> + * @param old
> + * Node pointer to replace in all graphs.
> + * @param new
> + * Updated pointer.
> + */
> +void graph_node_replace_all(struct node *old, struct node *new);
> +
> /**
> * @internal
> *
> diff --git a/lib/graph/node.c b/lib/graph/node.c
> index cae1c809edc4..e3359fe490a5 100644
> --- a/lib/graph/node.c
> +++ b/lib/graph/node.c
> @@ -325,11 +325,15 @@ edge_update(struct node *node, struct node *prev, rte_edge_t from,
> need_realloc = max_edges > node->nb_edges;
> if (need_realloc) {
> sz = sizeof(struct node) + (max_edges * RTE_NODE_NAMESIZE);
> - new_node = realloc(node, sz);
> + new_node = malloc(sz);
> if (new_node == NULL) {
> rte_errno = ENOMEM;
> goto restore;
> } else {
> + sz = sizeof(*node) + (node->nb_edges * RTE_NODE_NAMESIZE);
> + memcpy(new_node, node, sz);
> + graph_node_replace_all(node, new_node);
> + free(node);
> node = new_node;
> }
> }
> --
> 2.51.1
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH dpdk] graph: fix use-after-free when updating edges with active graphs
2025-11-10 8:50 ` Jerin Jacob
@ 2025-11-11 14:19 ` Thomas Monjalon
0 siblings, 0 replies; 3+ messages in thread
From: Thomas Monjalon @ 2025-11-11 14:19 UTC (permalink / raw)
To: Robin Jarry
Cc: stable, dev, Jerin Jacob, Kiran Kumar K, Nithin Dabilpuram,
Zhirun Yan, Pavan Nikhilesh, stable, Jerin Jacob
10/11/2025 09:50, Jerin Jacob:
> On Sat, Nov 1, 2025 at 3:43 AM Robin Jarry <rjarry@redhat.com> wrote:
> >
> > After creating at least one graph and calling rte_node_edge_update to
> > add a new edge on a node which is in use in the graph, the node memory
> > is reallocated but the active graph still has a pointer to the freed
> > memory.
> >
> > When destroying the graph, it causes a use-after-free error detected by
> > libasan:
> >
> > ERROR: AddressSanitizer: heap-use-after-free
> > READ of size 8 at 0x7c4baa5e4da8 thread T0
> > #0 0x0000005ad224 in graph_node_fini lib/graph/graph.c:256
> > #1 0x0000005ae657 in rte_graph_destroy lib/graph/graph.c:504
> > ...
> >
> > freed by thread T0 here:
> > #0 0x7f1bac4e5e4b in realloc.part.0 (/lib64/libasan.so.8+0xe5e4b)
> > #1 0x0000005ab6d7 in edge_update lib/graph/node.c:271
> > #2 0x0000005abb1b in rte_node_edge_update lib/graph/node.c:339
> > ...
> >
> > previously allocated by thread T0 here:
> > #0 0x7f1bac4e5e4b in realloc.part.0 (/lib64/libasan.so.8+0xe5e4b)
> > #1 0x0000005ab6d7 in edge_update lib/graph/node.c:271
> > #2 0x0000005abb1b in rte_node_edge_update lib/graph/node.c:339
> > ...
> >
> > Use malloc+memcpy and add an internal function to replace all references
> > to the old node memory before freeing it.
> >
> > Cc: stable@dpdk.org
> > Fixes: c59dac2ca14a ("graph: implement node operations")
> >
> > Signed-off-by: Robin Jarry <rjarry@redhat.com>
>
> Acked-by: Jerin Jacob <jerinj@marvell.com>
Applied, thanks.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2025-11-11 14:19 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2025-10-31 22:13 [PATCH dpdk] graph: fix use-after-free when updating edges with active graphs Robin Jarry
2025-11-10 8:50 ` Jerin Jacob
2025-11-11 14:19 ` Thomas Monjalon
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).