[dpdk-stable] patch 'ipc: fix use-after-free in synchronous requests' has been queued to stable release 18.02.2

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 18.02.2

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 05/02/18. So please
shout if anyone has objections.

Thanks.

Luca Boccassi

---
>From d64cf5c8efaff7c3c6640fbdc04bc4ac2372b1dd Mon Sep 17 00:00:00 2001
From: Anatoly Burakov <anatoly.burakov at intel.com>
Date: Fri, 13 Apr 2018 12:54:59 +0100
Subject: [PATCH] ipc: fix use-after-free in synchronous requests

[ upstream commit fe98e52a52f0989c299883bf7c231b64ae1cd242 ]

Previously, we were adding synchronous requests to request list, we
were doing it after checking if request existed. However, we only
removed the request from the request list if we have succeeded in
sending the request. In case of failed request send, we left an
invalid pointer in the request list.

Fix this by only adding request to the list once we succeed in
sending it.

Fixes: 783b6e54971d ("eal: add synchronous multi-process communication")

Signed-off-by: Anatoly Burakov <anatoly.burakov at intel.com>
Acked-by: Jianfeng Tan <jianfeng.tan at intel.com>
---
 lib/librte_eal/common/eal_common_proc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/librte_eal/common/eal_common_proc.c b/lib/librte_eal/common/eal_common_proc.c
index da7930f56..dccf9ab09 100644
--- a/lib/librte_eal/common/eal_common_proc.c
+++ b/lib/librte_eal/common/eal_common_proc.c
@@ -559,8 +559,6 @@ mp_request_one(const char *dst, struct rte_mp_msg *req,
 
 	pthread_mutex_lock(&sync_requests.lock);
 	exist = find_sync_request(dst, req->name);
-	if (!exist)
-		TAILQ_INSERT_TAIL(&sync_requests.requests, &sync_req, next);
 	if (exist) {
 		RTE_LOG(ERR, EAL, "A pending request %s:%s\n", dst, req->name);
 		rte_errno = EEXIST;
@@ -576,6 +574,8 @@ mp_request_one(const char *dst, struct rte_mp_msg *req,
 	} else if (ret == 0)
 		return 0;
 
+	TAILQ_INSERT_TAIL(&sync_requests.requests, &sync_req, next);
+
 	reply->nb_sent++;
 
 	do {
-- 
2.14.2