[1/1] net/txgbe: fix use-after-free on remove
Checks
Commit Message
When cleaning up NIC's interrupts, it is possible to add some alarms
at the same time. However, if these alarms are not canceled, it may
cause use-after-free problems. Therefore, after cleaning up NIC's
interrupts, these alarms should also be canceled.
Fixes: d3bb4a04eac1 ("net/txgbe: add SFP hotplug identification")
Fixes: e0d876ef6bbc ("net/txgbe: support device stop and close")
Cc: stable@dpdk.org
Reported-by: Pengfei Sun <sunpengfei16@huawei.com>
Signed-off-by: Yunjian Wang <wangyunjian@huawei.com>
---
drivers/net/txgbe/txgbe_ethdev.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
Comments
> When cleaning up NIC's interrupts, it is possible to add some alarms
> at the same time. However, if these alarms are not canceled, it may
> cause use-after-free problems. Therefore, after cleaning up NIC's
> interrupts, these alarms should also be canceled.
>
> Fixes: d3bb4a04eac1 ("net/txgbe: add SFP hotplug identification")
> Fixes: e0d876ef6bbc ("net/txgbe: support device stop and close")
> Cc: stable@dpdk.org
>
> Reported-by: Pengfei Sun <sunpengfei16@huawei.com>
> Signed-off-by: Yunjian Wang <wangyunjian@huawei.com>
> ---
> drivers/net/txgbe/txgbe_ethdev.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/net/txgbe/txgbe_ethdev.c b/drivers/net/txgbe/txgbe_ethdev.c
> index a502618bc5..a3d7461951 100644
> --- a/drivers/net/txgbe/txgbe_ethdev.c
> +++ b/drivers/net/txgbe/txgbe_ethdev.c
> @@ -2032,8 +2032,10 @@ txgbe_dev_close(struct rte_eth_dev *dev)
> rte_delay_ms(100);
> } while (retries++ < (10 + TXGBE_LINK_UP_TIME));
>
> - /* cancel the delay handler before remove dev */
> + /* cancel all alarm handler before remove dev */
> rte_eal_alarm_cancel(txgbe_dev_interrupt_delayed_handler, dev);
> + rte_eal_alarm_cancel(txgbe_dev_detect_sfp, dev);
> + rte_eal_alarm_cancel(txgbe_dev_setup_link_alarm_handler, dev);
>
> /* uninitialize PF if max_vfs not zero */
> txgbe_pf_host_uninit(dev);
> --
> 2.33.0
>
>
Reviewed-by: Jiawen Wu <jiawenwu@trustnetic.com>
On 5/18/2023 8:46 AM, Jiawen Wu wrote:
>> When cleaning up NIC's interrupts, it is possible to add some alarms
>> at the same time. However, if these alarms are not canceled, it may
>> cause use-after-free problems. Therefore, after cleaning up NIC's
>> interrupts, these alarms should also be canceled.
>>
>> Fixes: d3bb4a04eac1 ("net/txgbe: add SFP hotplug identification")
>> Fixes: e0d876ef6bbc ("net/txgbe: support device stop and close")
>> Cc: stable@dpdk.org
>>
>> Reported-by: Pengfei Sun <sunpengfei16@huawei.com>
>> Signed-off-by: Yunjian Wang <wangyunjian@huawei.com>
>> ---
>> drivers/net/txgbe/txgbe_ethdev.c | 4 +++-
>> 1 file changed, 3 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/net/txgbe/txgbe_ethdev.c b/drivers/net/txgbe/txgbe_ethdev.c
>> index a502618bc5..a3d7461951 100644
>> --- a/drivers/net/txgbe/txgbe_ethdev.c
>> +++ b/drivers/net/txgbe/txgbe_ethdev.c
>> @@ -2032,8 +2032,10 @@ txgbe_dev_close(struct rte_eth_dev *dev)
>> rte_delay_ms(100);
>> } while (retries++ < (10 + TXGBE_LINK_UP_TIME));
>>
>> - /* cancel the delay handler before remove dev */
>> + /* cancel all alarm handler before remove dev */
>> rte_eal_alarm_cancel(txgbe_dev_interrupt_delayed_handler, dev);
>> + rte_eal_alarm_cancel(txgbe_dev_detect_sfp, dev);
>> + rte_eal_alarm_cancel(txgbe_dev_setup_link_alarm_handler, dev);
>>
>> /* uninitialize PF if max_vfs not zero */
>> txgbe_pf_host_uninit(dev);
>> --
>> 2.33.0
>>
>>
>
> Reviewed-by: Jiawen Wu <jiawenwu@trustnetic.com>
>
>
Applied to dpdk-next-net/main, thanks.
@@ -2032,8 +2032,10 @@ txgbe_dev_close(struct rte_eth_dev *dev)
rte_delay_ms(100);
} while (retries++ < (10 + TXGBE_LINK_UP_TIME));
- /* cancel the delay handler before remove dev */
+ /* cancel all alarm handler before remove dev */
rte_eal_alarm_cancel(txgbe_dev_interrupt_delayed_handler, dev);
+ rte_eal_alarm_cancel(txgbe_dev_detect_sfp, dev);
+ rte_eal_alarm_cancel(txgbe_dev_setup_link_alarm_handler, dev);
/* uninitialize PF if max_vfs not zero */
txgbe_pf_host_uninit(dev);