patches for DPDK stable branches
 help / color / mirror / Atom feed
From: Rui Ferreira <rui.ferreira1@h-partners.com>
To: Bruce Richardson <bruce.richardson@intel.com>
Cc: <dev@dpdk.org>, <stable@dpdk.org>
Subject: [PATCH v2 2/2] fix eal/freebsd: unregister alarm callback before free
Date: Fri, 30 May 2025 09:18:44 +0100	[thread overview]
Message-ID: <20250530081845.64297-3-rui.ferreira1@h-partners.com> (raw)
In-Reply-To: <20250530081845.64297-1-rui.ferreira1@h-partners.com>

Unregister callback on cleanup to avoid use after free from the
interrupt thread (eal_intr_thread_main).

To be more defensive, set ptr to NULL if we can unregister.

rte_intr_callback_unregister_sync may (optionally) use traces
so the alarm cleanup must happen before eal_trace_fini to avoid
accessing freed memory.

Bugzilla ID: 1683

Signed-off-by: Rui Ferreira <rui.ferreira1@h-partners.com>
---
 lib/eal/freebsd/eal.c       | 3 ++-
 lib/eal/freebsd/eal_alarm.c | 8 +++++++-
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/lib/eal/freebsd/eal.c b/lib/eal/freebsd/eal.c
index d6fffa2170..21ce4e6b18 100644
--- a/lib/eal/freebsd/eal.c
+++ b/lib/eal/freebsd/eal.c
@@ -907,8 +907,9 @@ rte_eal_cleanup(void)
 	rte_mp_channel_cleanup();
 	eal_bus_cleanup();
 	rte_trace_save();
-	eal_trace_fini();
+	/* may use trace, must be called before eal_trace_fini */
 	rte_eal_alarm_cleanup();
+	eal_trace_fini();
 	/* after this point, any DPDK pointers will become dangling */
 	rte_eal_memory_detach();
 	eal_cleanup_config(internal_conf);
diff --git a/lib/eal/freebsd/eal_alarm.c b/lib/eal/freebsd/eal_alarm.c
index 28f285fdef..c03e281e67 100644
--- a/lib/eal/freebsd/eal_alarm.c
+++ b/lib/eal/freebsd/eal_alarm.c
@@ -50,7 +50,13 @@ static void eal_alarm_callback(void *arg);
 void
 rte_eal_alarm_cleanup(void)
 {
-	rte_intr_instance_free(intr_handle);
+	/* unregister callback using intr_handle in interrupt thread */
+	int ret = rte_intr_callback_unregister_sync(intr_handle,
+			eal_alarm_callback, (void *)-1);
+	if (ret >= 0) {
+		rte_intr_instance_free(intr_handle);
+		intr_handle = NULL;
+	}
 }
 
 int
-- 
2.43.0


      parent reply	other threads:[~2025-05-30  8:19 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <20250520160150.50401-1-rui.ferreira1@h-partners.com>
2025-05-22 15:59 ` [PATCH v2] fix eal/linux: " Rui Ferreira
2025-05-27 10:22   ` Konstantin Ananyev
2025-05-27 14:53   ` Thomas Monjalon
2025-05-29  8:39     ` Rui Ferreira (A)
2025-05-30  8:18       ` [PATCH v2 0/2] fix eal: " Rui Ferreira
2025-05-30  8:18         ` [PATCH v2 1/2] fix eal/linux: " Rui Ferreira
2025-05-30  8:18         ` Rui Ferreira [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20250530081845.64297-3-rui.ferreira1@h-partners.com \
    --to=rui.ferreira1@h-partners.com \
    --cc=bruce.richardson@intel.com \
    --cc=dev@dpdk.org \
    --cc=stable@dpdk.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).