[PATCH v2] tap: fix write-after-free and double free of intr_handle
David Marchand
david.marchand at redhat.com
Wed May 4 13:17:25 CEST 2022
On Tue, May 3, 2022 at 8:23 PM Quentin Armitage <quentin at armitage.org.uk> wrote:
>
> rte_pmd_tun/tap_probe() allocates pmd->intr_handle in eth_dev_tap_create()
> and it should not be freed until rte_pmd_tap_remove() is called.
>
> Inspection of tap_rx_intr_vec_set() shows that the call to
> tap_tx_intr_vec_uninstall() was calling rte_intr_instance_free() but
> tap_tx_intr_vec_install() can then be immediately called, and this then
> uses pmd->intr_handle without it being reallocated.
>
> This commit moves the call of rte_intr_instance_free() from
> tap_tx_intr_vec_uninstall() to rte_pmd_tap_remove().
>
> Fixes: d61138d4f0e2 ("drivers: remove direct access to interrupt handle")
Cc: stable at dpdk.org
https://doc.dpdk.org/guides/contributing/patches.html#patch-for-stable-releases
The reason is that backport scripts look for a "Cc: stable at dpdk.org"
in the commitlog itself.
(no need for a v3 just for this, it can be fixed when applying)
>
> Changes in v2:
> Move rte_intr_instance_free() from tap_rx_intr_vec_uninstall()
> to tap_dev_close().
Nit: revisions changelog should be added as annotations (i.e. put
after the --- after the commitlog).
>
> Signed-off-by: Quentin Armitage <quentin at armitage.org.uk>
I did not test the change, but the fix lgtm.
The CI failure from UNH is a false positive.
Reviewed-by: David Marchand <david.marchand at redhat.com>
--
David Marchand
More information about the stable
mailing list