From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 9B76846803 for ; Tue, 27 May 2025 12:22:51 +0200 (CEST) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 7A89440144; Tue, 27 May 2025 12:22:51 +0200 (CEST) Received: from frasgout.his.huawei.com (frasgout.his.huawei.com [185.176.79.56]) by mails.dpdk.org (Postfix) with ESMTP id A94B640144; Tue, 27 May 2025 12:22:50 +0200 (CEST) Received: from mail.maildlp.com (unknown [172.18.186.216]) by frasgout.his.huawei.com (SkyGuard) with ESMTP id 4b67sN04jbz6L5Dr; Tue, 27 May 2025 18:19:20 +0800 (CST) Received: from frapeml100008.china.huawei.com (unknown [7.182.85.131]) by mail.maildlp.com (Postfix) with ESMTPS id DA4F0140393; Tue, 27 May 2025 18:22:49 +0800 (CST) Received: from frapeml500007.china.huawei.com (7.182.85.172) by frapeml100008.china.huawei.com (7.182.85.131) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.1.2507.39; Tue, 27 May 2025 12:22:49 +0200 Received: from frapeml500007.china.huawei.com ([7.182.85.172]) by frapeml500007.china.huawei.com ([7.182.85.172]) with mapi id 15.01.2507.039; Tue, 27 May 2025 12:22:49 +0200 From: Konstantin Ananyev To: "Rui Ferreira (A)" , Thomas Monjalon CC: "dev@dpdk.org" , "stable@dpdk.org" Subject: RE: [PATCH v2] fix eal/linux: unregister alarm callback before free Thread-Topic: [PATCH v2] fix eal/linux: unregister alarm callback before free Thread-Index: AQHbyytZFwMSgv5A0UC8Gz2xCRweu7PmTALw Date: Tue, 27 May 2025 10:22:49 +0000 Message-ID: <2885c0014ac54593ac60d2ce226cbc48@huawei.com> References: <20250520160150.50401-1-rui.ferreira1@h-partners.com> <20250522155944.65342-1-rui.ferreira1@h-partners.com> In-Reply-To: <20250522155944.65342-1-rui.ferreira1@h-partners.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.206.138.73] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: patches for DPDK stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: stable-bounces@dpdk.org > This was flagged by Address sanitizer as a use after free. The > intr_handle ptr is shared between the main thread and the interrupt > thread. The interrupt thread can dereference the ptr after free (from > the alarm callback). free is called when the main thread cleans up. >=20 > The interrupt thread never terminates (eal_intr_thread_main) so > use rte_intr_callback_unregister_sync during cleanup to > ensure the callback is removed before freeing the ptr. >=20 > To be more defensive clear out the pointer and registration > variable if we can unregister. >=20 > rte_intr_callback_unregister_sync may (optionally) use traces > so the alarm cleanup must happen before eal_trace_fini to avoid > accessing freed memory. >=20 > Bugzilla ID: 1683 >=20 > Signed-off-by: Rui Ferreira > --- > .mailmap | 1 + > lib/eal/linux/eal.c | 3 ++- > lib/eal/linux/eal_alarm.c | 9 ++++++++- > 3 files changed, 11 insertions(+), 2 deletions(-) >=20 > diff --git a/.mailmap b/.mailmap > index d8439b79ce..907c5ea967 100644 > --- a/.mailmap > +++ b/.mailmap > @@ -1332,6 +1332,7 @@ Rosen Xu > Roy Franz > Roy Pledge > Roy Shterman > +Rui Ferreira > Ruifeng Wang > Rushil Gupta > Ryan E Hall > diff --git a/lib/eal/linux/eal.c b/lib/eal/linux/eal.c > index 20f777b8b0..b448db1392 100644 > --- a/lib/eal/linux/eal.c > +++ b/lib/eal/linux/eal.c > @@ -1329,9 +1329,10 @@ rte_eal_cleanup(void) > rte_mp_channel_cleanup(); > eal_bus_cleanup(); > rte_trace_save(); > + /* may use trace, must be called before eal_trace_fini */ > + rte_eal_alarm_cleanup(); > eal_trace_fini(); > eal_mp_dev_hotplug_cleanup(); > - rte_eal_alarm_cleanup(); > /* after this point, any DPDK pointers will become dangling */ > rte_eal_memory_detach(); > rte_eal_malloc_heap_cleanup(); > diff --git a/lib/eal/linux/eal_alarm.c b/lib/eal/linux/eal_alarm.c > index b216a007a3..eb6a21d4f0 100644 > --- a/lib/eal/linux/eal_alarm.c > +++ b/lib/eal/linux/eal_alarm.c > @@ -57,7 +57,14 @@ static void eal_alarm_callback(void *arg); > void > rte_eal_alarm_cleanup(void) > { > - rte_intr_instance_free(intr_handle); > + /* unregister callback using intr_handle in interrupt thread */ > + int ret =3D rte_intr_callback_unregister_sync(intr_handle, > + eal_alarm_callback, (void *)-1); > + if (ret >=3D 0) { > + rte_intr_instance_free(intr_handle); > + intr_handle =3D NULL; > + handler_registered =3D 0; > + } > } >=20 > int > -- Acked-by: Konstantin Ananyev =20 > 2.35.3