[dpdk-stable] [dpdk-dev] [PATCH v4 5/5] net/tap: fix leak of fds on failure

[dpdk-stable] [dpdk-dev] [PATCH v4 5/5] net/tap: fix leak of fds on failure

[wangyunjian]

From: Yunjian Wang <wangyunjian@huawei.com>

When eth_dev_tap_create() is failed, nlsk_fd and ka_fd won't be closed
thus leading fds leak. Zero is a valid fd. Ultimately leads to a valid
fd was closed by mistake.

Fixes: bf7b7f437b49 ("net/tap: create netdevice during probing")
Fixes: cb7e68da630a ("net/tap: fix cleanup on allocation failure")
CC: stable@dpdk.org

Signed-off-by: Yunjian Wang <wangyunjian@huawei.com>
---
 drivers/net/tap/rte_eth_tap.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/net/tap/rte_eth_tap.c b/drivers/net/tap/rte_eth_tap.c
index 829a9e9b4..9bea5d9d0 100644
--- a/drivers/net/tap/rte_eth_tap.c
+++ b/drivers/net/tap/rte_eth_tap.c
@@ -1820,6 +1820,8 @@ eth_dev_tap_create(struct rte_vdev_device *vdev, const char *tap_name,
 	pmd->dev = dev;
 	strlcpy(pmd->name, tap_name, sizeof(pmd->name));
 	pmd->type = type;
+	pmd->ka_fd = -1;
+	pmd->nlsk_fd = -1;
 
 	pmd->ioctl_sock = socket(AF_INET, SOCK_DGRAM, 0);
 	if (pmd->ioctl_sock == -1) {
@@ -1850,7 +1852,6 @@ eth_dev_tap_create(struct rte_vdev_device *vdev, const char *tap_name,
 	dev->intr_handle = &pmd->intr_handle;
 
 	/* Presetup the fds to -1 as being not valid */
-	pmd->ka_fd = -1;
 	for (i = 0; i < RTE_PMD_TAP_MAX_QUEUES; i++) {
 		process_private->rxq_fds[i] = -1;
 		process_private->txq_fds[i] = -1;
@@ -1990,7 +1991,11 @@ eth_dev_tap_create(struct rte_vdev_device *vdev, const char *tap_name,
 	tap_flow_implicit_flush(pmd, NULL);
 
 error_exit:
-	if (pmd->ioctl_sock > 0)
+	if (pmd->nlsk_fd == -1)
+		close(pmd->nlsk_fd);
+	if (pmd->ka_fd != -1)
+		close(pmd->ka_fd);
+	if (pmd->ioctl_sock != -1)
 		close(pmd->ioctl_sock);
 	/* mac_addrs must not be freed alone because part of dev_private */
 	dev->data->mac_addrs = NULL;
-- 
2.19.1

Re: [dpdk-stable] [dpdk-dev] [PATCH v4 5/5] net/tap: fix leak of fds on failure

[Ferruh Yigit]

On 4/11/2020 12:24 PM, wangyunjian wrote:
> From: Yunjian Wang <wangyunjian@huawei.com>
> 
> When eth_dev_tap_create() is failed, nlsk_fd and ka_fd won't be closed
> thus leading fds leak. Zero is a valid fd. Ultimately leads to a valid
> fd was closed by mistake.
> 
> Fixes: bf7b7f437b49 ("net/tap: create netdevice during probing")
> Fixes: cb7e68da630a ("net/tap: fix cleanup on allocation failure")
> CC: stable@dpdk.org
> 
> Signed-off-by: Yunjian Wang <wangyunjian@huawei.com>
> ---
>  drivers/net/tap/rte_eth_tap.c | 9 +++++++--
>  1 file changed, 7 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/tap/rte_eth_tap.c b/drivers/net/tap/rte_eth_tap.c
> index 829a9e9b4..9bea5d9d0 100644
> --- a/drivers/net/tap/rte_eth_tap.c
> +++ b/drivers/net/tap/rte_eth_tap.c
> @@ -1820,6 +1820,8 @@ eth_dev_tap_create(struct rte_vdev_device *vdev, const char *tap_name,
>  	pmd->dev = dev;
>  	strlcpy(pmd->name, tap_name, sizeof(pmd->name));
>  	pmd->type = type;
> +	pmd->ka_fd = -1;
> +	pmd->nlsk_fd = -1;
>  
>  	pmd->ioctl_sock = socket(AF_INET, SOCK_DGRAM, 0);
>  	if (pmd->ioctl_sock == -1) {
> @@ -1850,7 +1852,6 @@ eth_dev_tap_create(struct rte_vdev_device *vdev, const char *tap_name,
>  	dev->intr_handle = &pmd->intr_handle;
>  
>  	/* Presetup the fds to -1 as being not valid */
> -	pmd->ka_fd = -1;
>  	for (i = 0; i < RTE_PMD_TAP_MAX_QUEUES; i++) {
>  		process_private->rxq_fds[i] = -1;
>  		process_private->txq_fds[i] = -1;
> @@ -1990,7 +1991,11 @@ eth_dev_tap_create(struct rte_vdev_device *vdev, const char *tap_name,
>  	tap_flow_implicit_flush(pmd, NULL);
>  
>  error_exit:
> -	if (pmd->ioctl_sock > 0)
> +	if (pmd->nlsk_fd == -1)
> +		close(pmd->nlsk_fd);

Shouldn't this be '!=', "pmd->nlsk_fd != -1"?

Re: [dpdk-stable] [dpdk-dev] [PATCH v4 5/5] net/tap: fix leak of fds on failure

[wangyunjian]

> -----Original Message-----
> From: Ferruh Yigit [mailto:ferruh.yigit@intel.com]
> Sent: Wednesday, April 15, 2020 11:15 PM
> To: wangyunjian <wangyunjian@huawei.com>; dev@dpdk.org
> Cc: keith.wiles@intel.com; Lilijun (Jerry) <jerry.lilijun@huawei.com>; xudingke
> <xudingke@huawei.com>; stable@dpdk.org
> Subject: Re: [dpdk-dev] [PATCH v4 5/5] net/tap: fix leak of fds on failure
> 
> On 4/11/2020 12:24 PM, wangyunjian wrote:
> > From: Yunjian Wang <wangyunjian@huawei.com>
> >
> > When eth_dev_tap_create() is failed, nlsk_fd and ka_fd won't be closed
> > thus leading fds leak. Zero is a valid fd. Ultimately leads to a valid
> > fd was closed by mistake.
> >
> > Fixes: bf7b7f437b49 ("net/tap: create netdevice during probing")
> > Fixes: cb7e68da630a ("net/tap: fix cleanup on allocation failure")
> > CC: stable@dpdk.org
> >
> > Signed-off-by: Yunjian Wang <wangyunjian@huawei.com>
> > ---
> >  drivers/net/tap/rte_eth_tap.c | 9 +++++++--
> >  1 file changed, 7 insertions(+), 2 deletions(-)
> >
> > diff --git a/drivers/net/tap/rte_eth_tap.c
> > b/drivers/net/tap/rte_eth_tap.c index 829a9e9b4..9bea5d9d0 100644
> > --- a/drivers/net/tap/rte_eth_tap.c
> > +++ b/drivers/net/tap/rte_eth_tap.c
> > @@ -1820,6 +1820,8 @@ eth_dev_tap_create(struct rte_vdev_device *vdev,
> const char *tap_name,
> >  	pmd->dev = dev;
> >  	strlcpy(pmd->name, tap_name, sizeof(pmd->name));
> >  	pmd->type = type;
> > +	pmd->ka_fd = -1;
> > +	pmd->nlsk_fd = -1;
> >
> >  	pmd->ioctl_sock = socket(AF_INET, SOCK_DGRAM, 0);
> >  	if (pmd->ioctl_sock == -1) {
> > @@ -1850,7 +1852,6 @@ eth_dev_tap_create(struct rte_vdev_device *vdev,
> const char *tap_name,
> >  	dev->intr_handle = &pmd->intr_handle;
> >
> >  	/* Presetup the fds to -1 as being not valid */
> > -	pmd->ka_fd = -1;
> >  	for (i = 0; i < RTE_PMD_TAP_MAX_QUEUES; i++) {
> >  		process_private->rxq_fds[i] = -1;
> >  		process_private->txq_fds[i] = -1;
> > @@ -1990,7 +1991,11 @@ eth_dev_tap_create(struct rte_vdev_device
> *vdev, const char *tap_name,
> >  	tap_flow_implicit_flush(pmd, NULL);
> >
> >  error_exit:
> > -	if (pmd->ioctl_sock > 0)
> > +	if (pmd->nlsk_fd == -1)
> > +		close(pmd->nlsk_fd);
> 
> Shouldn't this be '!=', "pmd->nlsk_fd != -1"?

I'm sorry for my mistakes. I will fix it in next version.

Thanks,
Yunjian