From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 3F715A0A0A for ; Fri, 21 May 2021 17:49:27 +0200 (CEST) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 0D49D40143; Fri, 21 May 2021 17:49:27 +0200 (CEST) Received: from mail-qt1-f180.google.com (mail-qt1-f180.google.com [209.85.160.180]) by mails.dpdk.org (Postfix) with ESMTP id 81D9740143 for ; Fri, 21 May 2021 17:49:26 +0200 (CEST) Received: by mail-qt1-f180.google.com with SMTP id g8so8086048qtp.4 for ; Fri, 21 May 2021 08:49:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=a1zPwHzaKVzBNAiSRCJZsT04pOdEvKu1z5HT/oiX6DY=; b=Tea53AHCcY3CvdoofIriZMTRmEIZLRwWeP/KWc8s2S+ebKUHgh8TEZdAHR17E5uQ8y spyneRxYiW3RgcKMXtcGGAco6SFQaqcebOBxF80jzZUXv+m+8qGvVqM9tYciEeNyYzES 0CKHiIaw+J47+L+hWQcZNrK2qBb2lWbGkiNzk492+UX8aiL+BHNnOKW2Mx8ekKOBwwEU 6OgXRiPOiZLcsFyAuIXGg6tujdq4qG9VoRwpmLD/qokK/8u0oAVV/N9L0pmzpQ4xqcm3 989LaI1Jy1YQ+71S1BAGkCfCYyTf3TuT5e381ChadK3htKjuh/WrIwE7KNji4+XQ0yi/ 9kAg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=a1zPwHzaKVzBNAiSRCJZsT04pOdEvKu1z5HT/oiX6DY=; b=DuURTzyV9oWM/jzkDseM5/eLxAbg+bZ+TuSWLVf4VDOxe2MY1/8N0nO3VV9qlSblwh MoZIhJdEV0U/ZDKQC7GiI0ahZ4eGkI28oF/QGkFuPAWZEvTvXivoeANT7QYYbqBxoY7T FmYmEiVs960481vC/AnxqR6KLEe/hnp1qYj/caWJzhcXbHiVGn2tzdIKw0CS0AC8mXHK 7sAUon6CaKs4sVNrxiu/Yb2ibkTcbJ95TVlp6/67rxMIoDUxMLnk3KyLmrhe96NNQnFc eclnFkY+S3HbWdpZVmwWs/hhgJuqms325x3xX8kvGPaq1upH+V59h32PYNCTwV3hL0G0 qJng== X-Gm-Message-State: AOAM532hFeOw71PJvQKMYM1BNRpKecoqNQ70yCdZzxbDkMMPkpTJ/Gbh PhXXDnESL1jN/rybY0k30IQ= X-Google-Smtp-Source: ABdhPJyIy79zaqZXcvckUu3FWRiAg7VSJc8psblMdnvgluNMS915nsEza38CP9h1EocsmgN73Rz4lg== X-Received: by 2002:aed:314f:: with SMTP id 73mr12704145qtg.194.1621612165962; Fri, 21 May 2021 08:49:25 -0700 (PDT) Received: from localhost.localdomain (bras-base-hullpq2034w-grc-18-74-15-213-177.dsl.bell.ca. [74.15.213.177]) by smtp.gmail.com with ESMTPSA id q12sm4813969qtl.13.2021.05.21.08.49.25 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 21 May 2021 08:49:25 -0700 (PDT) From: Luc Pelletier To: christian.ehrhardt@canonical.com, stable@dpdk.org Cc: Luc Pelletier Date: Fri, 21 May 2021 11:49:06 -0400 Message-Id: <20210521154907.320565-1-lucp.at.work@gmail.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Subject: [dpdk-stable] [PATCH 19.11.9 1/2] eal: fix race in control thread creation X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: patches for DPDK stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: stable-bounces@dpdk.org Sender: "stable" [ upstream commit 34cc55cce6b180a6c3ee3fcf70a0fd56927f240d ] The creation of control threads uses a pthread barrier for synchronization. This patch fixes a race condition where the pthread barrier could get destroyed while one of the threads has not yet returned from the pthread_barrier_wait function, which could result in undefined behaviour. Fixes: 3a0d465d4c53 ("eal: fix use-after-free on control thread creation") --- lib/librte_eal/common/eal_common_thread.c | 49 +++++++++++++---------- 1 file changed, 27 insertions(+), 22 deletions(-) diff --git a/lib/librte_eal/common/eal_common_thread.c b/lib/librte_eal/common/eal_common_thread.c index f9a8cf14d..a5089ae49 100644 --- a/lib/librte_eal/common/eal_common_thread.c +++ b/lib/librte_eal/common/eal_common_thread.c @@ -147,20 +147,25 @@ struct rte_thread_ctrl_params { void *(*start_routine)(void *); void *arg; pthread_barrier_t configured; + unsigned int refcnt; }; +static void ctrl_params_free(struct rte_thread_ctrl_params *params) +{ + if (__atomic_sub_fetch(¶ms->refcnt, 1, __ATOMIC_ACQ_REL) == 0) { + (void)pthread_barrier_destroy(¶ms->configured); + free(params); + } +} + static void *rte_thread_init(void *arg) { - int ret; struct rte_thread_ctrl_params *params = arg; void *(*start_routine)(void *) = params->start_routine; void *routine_arg = params->arg; - ret = pthread_barrier_wait(¶ms->configured); - if (ret == PTHREAD_BARRIER_SERIAL_THREAD) { - pthread_barrier_destroy(¶ms->configured); - free(params); - } + pthread_barrier_wait(¶ms->configured); + ctrl_params_free(params); return start_routine(routine_arg); } @@ -180,15 +185,18 @@ rte_ctrl_thread_create(pthread_t *thread, const char *name, params->start_routine = start_routine; params->arg = arg; + params->refcnt = 2; - pthread_barrier_init(¶ms->configured, NULL, 2); - - ret = pthread_create(thread, attr, rte_thread_init, (void *)params); + ret = pthread_barrier_init(¶ms->configured, NULL, 2); if (ret != 0) { free(params); return -ret; } + ret = pthread_create(thread, attr, rte_thread_init, (void *)params); + if (ret != 0) + goto fail; + if (name != NULL) { ret = rte_thread_setname(*thread, name); if (ret < 0) @@ -197,24 +205,21 @@ rte_ctrl_thread_create(pthread_t *thread, const char *name, } ret = pthread_setaffinity_np(*thread, sizeof(*cpuset), cpuset); - if (ret) - goto fail; + if (ret != 0) + goto fail_cancel; - ret = pthread_barrier_wait(¶ms->configured); - if (ret == PTHREAD_BARRIER_SERIAL_THREAD) { - pthread_barrier_destroy(¶ms->configured); - free(params); - } + pthread_barrier_wait(¶ms->configured); + ctrl_params_free(params); return 0; -fail: - if (PTHREAD_BARRIER_SERIAL_THREAD == - pthread_barrier_wait(¶ms->configured)) { - pthread_barrier_destroy(¶ms->configured); - free(params); - } +fail_cancel: pthread_cancel(*thread); pthread_join(*thread, NULL); + +fail: + (void)pthread_barrier_destroy(¶ms->configured); + free(params); + return -ret; } -- 2.25.1