Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/48208/?format=api
{ "id": 48208, "url": "http://patchwork.dpdk.org/api/patches/48208/?format=api", "web_url": "http://patchwork.dpdk.org/project/dpdk/patch/3ac0562bbdfbabbcb2bdf5fec9e0ffa777475e2b.1542727150.git.anatoly.burakov@intel.com/", "project": { "id": 1, "url": "http://patchwork.dpdk.org/api/projects/1/?format=api", "name": "DPDK", "link_name": "dpdk", "list_id": "dev.dpdk.org", "list_email": "dev@dpdk.org", "web_url": "http://core.dpdk.org", "scm_url": "git://dpdk.org/dpdk", "webscm_url": "http://git.dpdk.org/dpdk", "list_archive_url": "https://inbox.dpdk.org/dev", "list_archive_url_format": "https://inbox.dpdk.org/dev/{}", "commit_url_format": "" }, "msgid": "<3ac0562bbdfbabbcb2bdf5fec9e0ffa777475e2b.1542727150.git.anatoly.burakov@intel.com>", "list_archive_url": "https://inbox.dpdk.org/dev/3ac0562bbdfbabbcb2bdf5fec9e0ffa777475e2b.1542727150.git.anatoly.burakov@intel.com", "date": "2018-11-20T15:23:20", "name": "ipc: fix use-after-free on failed send", "commit_ref": null, "pull_url": null, "state": "superseded", "archived": true, "hash": "22ac6876fd953a1c276f0ac22c28860bc0357081", "submitter": { "id": 4, "url": "http://patchwork.dpdk.org/api/people/4/?format=api", "name": "Anatoly Burakov", "email": "anatoly.burakov@intel.com" }, "delegate": null, "mbox": "http://patchwork.dpdk.org/project/dpdk/patch/3ac0562bbdfbabbcb2bdf5fec9e0ffa777475e2b.1542727150.git.anatoly.burakov@intel.com/mbox/", "series": [ { "id": 2504, "url": "http://patchwork.dpdk.org/api/series/2504/?format=api", "web_url": "http://patchwork.dpdk.org/project/dpdk/list/?series=2504", "date": "2018-11-20T15:23:20", "name": "ipc: fix use-after-free on failed send", "version": 1, "mbox": "http://patchwork.dpdk.org/series/2504/mbox/" } ], "comments": "http://patchwork.dpdk.org/api/patches/48208/comments/", "check": "success", "checks": "http://patchwork.dpdk.org/api/patches/48208/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<dev-bounces@dpdk.org>", "X-Original-To": "patchwork@dpdk.org", "Delivered-To": "patchwork@dpdk.org", "Received": [ "from [92.243.14.124] (localhost [127.0.0.1])\n\tby dpdk.org (Postfix) with ESMTP id ACAB92B9E;\n\tTue, 20 Nov 2018 16:23:25 +0100 (CET)", "from mga07.intel.com (mga07.intel.com [134.134.136.100])\n\tby dpdk.org (Postfix) with ESMTP id A35B22B94\n\tfor <dev@dpdk.org>; Tue, 20 Nov 2018 16:23:23 +0100 (CET)", "from orsmga007.jf.intel.com ([10.7.209.58])\n\tby orsmga105.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384;\n\t20 Nov 2018 07:23:22 -0800", "from irvmail001.ir.intel.com ([163.33.26.43])\n\tby orsmga007.jf.intel.com with ESMTP; 20 Nov 2018 07:23:21 -0800", "from sivswdev01.ir.intel.com (sivswdev01.ir.intel.com\n\t[10.237.217.45])\n\tby irvmail001.ir.intel.com (8.14.3/8.13.6/MailSET/Hub) with ESMTP id\n\twAKFNLm2000555; Tue, 20 Nov 2018 15:23:21 GMT", "from sivswdev01.ir.intel.com (localhost [127.0.0.1])\n\tby sivswdev01.ir.intel.com with ESMTP id wAKFNK0K004468;\n\tTue, 20 Nov 2018 15:23:20 GMT", "(from aburakov@localhost)\n\tby sivswdev01.ir.intel.com with LOCAL id wAKFNK1D004457;\n\tTue, 20 Nov 2018 15:23:20 GMT" ], "X-Amp-Result": "SKIPPED(no attachment in message)", "X-Amp-File-Uploaded": "False", "X-ExtLoop1": "1", "X-IronPort-AV": "E=Sophos;i=\"5.56,257,1539673200\"; d=\"scan'208\";a=\"90770146\"", "From": "Anatoly Burakov <anatoly.burakov@intel.com>", "To": "dev@dpdk.org", "Cc": "thomas@monjalon.net", "Date": "Tue, 20 Nov 2018 15:23:20 +0000", "Message-Id": "<3ac0562bbdfbabbcb2bdf5fec9e0ffa777475e2b.1542727150.git.anatoly.burakov@intel.com>", "X-Mailer": "git-send-email 1.7.0.7", "Subject": "[dpdk-dev] [PATCH] ipc: fix use-after-free on failed send", "X-BeenThere": "dev@dpdk.org", "X-Mailman-Version": "2.1.15", "Precedence": "list", "List-Id": "DPDK patches and discussions <dev.dpdk.org>", "List-Unsubscribe": "<https://mails.dpdk.org/options/dev>,\n\t<mailto:dev-request@dpdk.org?subject=unsubscribe>", "List-Archive": "<http://mails.dpdk.org/archives/dev/>", "List-Post": "<mailto:dev@dpdk.org>", "List-Help": "<mailto:dev-request@dpdk.org?subject=help>", "List-Subscribe": "<https://mails.dpdk.org/listinfo/dev>,\n\t<mailto:dev-request@dpdk.org?subject=subscribe>", "Errors-To": "dev-bounces@dpdk.org", "Sender": "\"dev\" <dev-bounces@dpdk.org>" }, "content": "Previous fix for rte_panic has moved setting of alarm before\nsending the message. This means that whether we send a message,\nthe alarm would still trigger. The comment noted that cleanup\nwould happen in the alarm handler, but that's not what actually\nhappened - instead, in the event of failed send we freed the\nmemory in-place, before putting the request on the queue.\n\nThis works OK when the message is sent, but when sending the\nmessage fails, the alarm would still trigger with a pointer\nargument that points to non-existent memory, and cause\nmemory corruption.\n\nThere probably is a \"proper\" fix for this issue, with correct\nhandling of sent vs. unsent requests, however it would be\nsimpler just to sacrifice the sent request in the (extremely\nunlikely) event of alarm set failing. The other process would\nstill send a response, but it will be ignored by the sender.\n\nFixes: 45e5f49e87fb (\"ipc: remove panic in async request\")\n\nSigned-off-by: Anatoly Burakov <anatoly.burakov@intel.com>\n---\n lib/librte_eal/common/eal_common_proc.c | 36 ++++++++-----------------\n 1 file changed, 11 insertions(+), 25 deletions(-)", "diff": "diff --git a/lib/librte_eal/common/eal_common_proc.c b/lib/librte_eal/common/eal_common_proc.c\nindex f65ef56c0..375e98709 100644\n--- a/lib/librte_eal/common/eal_common_proc.c\n+++ b/lib/librte_eal/common/eal_common_proc.c\n@@ -827,20 +827,17 @@ mp_request_async(const char *dst, struct rte_mp_msg *req,\n \t\tgoto fail;\n \t}\n \n-\t/*\n-\t * set the alarm before sending message. there are two possible error\n-\t * scenarios to consider here:\n-\t *\n-\t * - if the alarm set fails, we free the memory right there\n-\t * - if the alarm set succeeds but sending message fails, then the alarm\n-\t * will trigger and clean up the memory\n-\t *\n-\t * Even if the alarm triggers too early (i.e. immediately), we're still\n-\t * holding the lock to pending requests queue, so the interrupt thread\n-\t * will just spin until we release the lock, and either release the\n-\t * memory, or doesn't find any pending requests in the queue because we\n-\t * never added any due to send message failure.\n-\t */\n+\tret = send_msg(dst, req, MP_REQ);\n+\tif (ret < 0) {\n+\t\tRTE_LOG(ERR, EAL, \"Fail to send request %s:%s\\n\",\n+\t\t\tdst, req->name);\n+\t\tret = -1;\n+\t\tgoto fail;\n+\t} else if (ret == 0) {\n+\t\tret = 0;\n+\t\tgoto fail;\n+\t}\n+\t/* if alarm set fails, we simply ignore the reply */\n \tif (rte_eal_alarm_set(ts->tv_sec * 1000000 + ts->tv_nsec / 1000,\n \t\t\t async_reply_handle, pending_req) < 0) {\n \t\tRTE_LOG(ERR, EAL, \"Fail to set alarm for request %s:%s\\n\",\n@@ -848,17 +845,6 @@ mp_request_async(const char *dst, struct rte_mp_msg *req,\n \t\tret = -1;\n \t\tgoto fail;\n \t}\n-\n-\tret = send_msg(dst, req, MP_REQ);\n-\tif (ret < 0) {\n-\t\tRTE_LOG(ERR, EAL, \"Fail to send request %s:%s\\n\",\n-\t\t\tdst, req->name);\n-\t\tret = -1;\n-\t\tgoto fail;\n-\t} else if (ret == 0) {\n-\t\tret = 0;\n-\t\tgoto fail;\n-\t}\n \tTAILQ_INSERT_TAIL(&pending_requests.requests, pending_req, next);\n \n \tparam->user_reply.nb_sent++;\n", "prefixes": [] }