From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 322ABA0C46; Tue, 14 Sep 2021 13:29:41 +0200 (CEST) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 1BC8B4068F; Tue, 14 Sep 2021 13:29:41 +0200 (CEST) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [216.205.24.124]) by mails.dpdk.org (Postfix) with ESMTP id E6A984003C for ; Tue, 14 Sep 2021 13:29:38 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1631618978; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=lX3+5MbIuacYlXrLYRks5WF50nTJlj2q4LfX2T7W1vs=; b=dwsmKOLbvy8PT8yHwl4ZthZ9+4XiNnILIKk3V2pZyiQ3IdcBHtXOEIbL1+yduAOmRsvlJ6 /xd/aK91WhqzSxHBzuVbeRRND5D5N9Lf7xgBqula5TjT+YuVcA8MX3Tx+xdmogbX1hT5hn uC+YIPFqJpAgg2/og/Tt6jYaJ9DPQMM= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-425-lT9dHj6APdi7AeUraZnN0A-1; Tue, 14 Sep 2021 07:29:37 -0400 X-MC-Unique: lT9dHj6APdi7AeUraZnN0A-1 Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id E25BD1811EC1; Tue, 14 Sep 2021 11:29:35 +0000 (UTC) Received: from [10.39.208.12] (unknown [10.39.208.12]) by smtp.corp.redhat.com (Postfix) with ESMTPS id CF9EF6A255; Tue, 14 Sep 2021 11:29:34 +0000 (UTC) To: Gaoxiang Liu , chenbo.xia@intel.com Cc: dev@dpdk.org, liugaoxiang@huawei.com References: <20210827141925.1500-1-gaoxiangliu0@163.com> <20210902154553.249-1-gaoxiangliu0@163.com> From: Maxime Coquelin Message-ID: Date: Tue, 14 Sep 2021 13:29:33 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.11.0 MIME-Version: 1.0 In-Reply-To: <20210902154553.249-1-gaoxiangliu0@163.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.11 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=maxime.coquelin@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Subject: Re: [dpdk-dev] [PATCH v7] vhost: fix crash on port deletion X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" On 9/2/21 5:45 PM, Gaoxiang Liu wrote: > The rte_vhost_driver_unregister() and vhost_user_read_cb() > can be called at the same time by 2 threads. > when memory of vsocket is freed in rte_vhost_driver_unregister(), > the invalid memory of vsocket is accessed in vhost_user_read_cb(). > It's a bug of both mode for vhost as server or client. > > E.g., vhostuser port is created as server. > Thread1 calls rte_vhost_driver_unregister(). > Before the listen fd is deleted from poll waiting fds, > "vhost-events" thread then calls vhost_user_server_new_connection(), > then a new conn fd is added in fdset when trying to reconnect. > "vhost-events" thread then calls vhost_user_read_cb() and > accesses invalid memory of socket while thread1 frees the memory of > vsocket. > > E.g., vhostuser port is created as client. > Thread1 calls rte_vhost_driver_unregister(). > Before vsocket of reconn is deleted from reconn list, > "vhost_reconn" thread then calls vhost_user_add_connection() > then a new conn fd is added in fdset when trying to reconnect. > "vhost-events" thread then calls vhost_user_read_cb() and > accesses invalid memory of socket while thread1 frees the memory of > vsocket. > > The fix is to move the "fdset_try_del" in front of free memory of conn, > then avoid the race condition. > > The core trace is: > Program terminated with signal 11, Segmentation fault. > > Fixes: 52d874dc6705 ("vhost: fix crash on closing in client mode") > > Signed-off-by: Gaoxiang Liu > --- > > v2: > * Fix coding style issues. > > v3: > * Add detailed log. > > v4: > * Add the reason, when vhostuser port is created as server. > > v5: > * Add detailed log when vhostuser port is created as client > > v6: > * Add 'path' check before deleting listen fd > * Fix spelling issues > > v7: > * Fix coding style issues. > --- > lib/vhost/socket.c | 107 ++++++++++++++++++++++----------------------- > 1 file changed, 53 insertions(+), 54 deletions(-) > Applied to dpdk-next-virtio/main. Thanks, Maxime