From patchwork Wed Aug 18 16:08:57 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gaoxiang Liu X-Patchwork-Id: 97063 X-Patchwork-Delegate: maxime.coquelin@redhat.com Return-Path: X-Original-To: patchwork@inbox.dpdk.org Delivered-To: patchwork@inbox.dpdk.org Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 278FFA0C4C; Wed, 18 Aug 2021 18:09:20 +0200 (CEST) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id D669C410F2; Wed, 18 Aug 2021 18:09:19 +0200 (CEST) Received: from m12-14.163.com (m12-14.163.com [220.181.12.14]) by mails.dpdk.org (Postfix) with ESMTP id E433A4069E for ; Wed, 18 Aug 2021 18:09:17 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=163.com; s=s110527; h=From:Subject:Date:Message-Id:MIME-Version; bh=T+HAj LsX4MsLcywEWABtfoTJ7maP28nP1vjkdionP64=; b=p2WviZXgv7C5UsbQ/4TZE f1kg8HxcuqlHu8OJFGcysX+SURIK2tLA3WHL2zsZXBH39ElCrEQ2brrVzlOknbMS ofTF9P6zkmJ81I3Of+II8157G2ZGv4N8NyWZENOVkS8AwOGOXK79ti43s/TikCW4 ilxdGWVco2y50NsCdnjevI= Received: from DESKTOP-ONA2IA7.localdomain (unknown [39.182.55.95]) by smtp10 (Coremail) with SMTP id DsCowABHBOKdMB1hGzb2Cg--.16412S4; Thu, 19 Aug 2021 00:09:14 +0800 (CST) From: Gaoxiang Liu To: maxime.coquelin@redhat.com, chenbo.xia@intel.com Cc: dev@dpdk.org, liugaoxiang@huawei.com, Gaoxiang Liu Date: Thu, 19 Aug 2021 00:08:57 +0800 Message-Id: <20210818160857.1729-1-gaoxiangliu0@163.com> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210813142248.88-1-gaoxiangliu0@163.com> References: <20210813142248.88-1-gaoxiangliu0@163.com> MIME-Version: 1.0 X-CM-TRANSID: DsCowABHBOKdMB1hGzb2Cg--.16412S4 X-Coremail-Antispam: 1Uf129KBjvJXoWxCryUZr47Kr43WryrZFyDAwb_yoW5GFW3pF y7KFy3Jr97Jrn5ZrZxAF4kXryrCan5ua17G3srGF15Ja1DGws0va9Fk3W09r1UtFW8XFyU tF1jgr4S9ayUA3DanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x07j4KZJUUUUU= X-Originating-IP: [39.182.55.95] X-CM-SenderInfo: xjdr5xxdqjzxjxq6il2tof0z/1tbiWwvyOlSIrO6i8QAAsV Subject: [dpdk-dev] [PATCH v4] vhost: fix crash on port deletion X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" The rte_vhost_driver_unregister() and vhost_user_server_new_connection() can be called at the same time by 2 threads. Eg thread1 calls rte_vhost_driver_unregister() and frees the memory of conn_list. "vhost-events" thread calls fdset_event_dispatch, then calls vhost_user_server_new_connection(). A new conn fd is added in fdset in vhost_user_server_new_connection(), then "vhost-events" thread calls vhost_user_read_cb(). when thread1 frees the memory of vsocket, vhost_user_read_cb() will access invalid memory of socket. When vhostuser port is created as a client, the issue also exists. The fix is to move the "fdset_try_del" in front of free memory of conn, then avoid the race condition. The core trace is: Program terminated with signal 11, Segmentation fault. Fixes: 52d874dc6705 ("vhost: fix crash on closing in client mode") Signed-off-by: Gaoxiang Liu v2: * Fix coding style issues v3: * Add detailed log v4: * Add the reason, when vhostuser port is created as a server. --- lib/vhost/socket.c | 27 ++++++++++++++------------- 1 file changed, 14 insertions(+), 13 deletions(-) diff --git a/lib/vhost/socket.c b/lib/vhost/socket.c index 5d0d728d5..2eb8fcadd 100644 --- a/lib/vhost/socket.c +++ b/lib/vhost/socket.c @@ -1024,6 +1024,20 @@ rte_vhost_driver_unregister(const char *path) for (i = 0; i < vhost_user.vsocket_cnt; i++) { struct vhost_user_socket *vsocket = vhost_user.vsockets[i]; + if (vsocket->is_server) { + /* + * If r/wcb is executing, release vhost_user's + * mutex lock, and try again since the r/wcb + * may use the mutex lock. + */ + if (fdset_try_del(&vhost_user.fdset, vsocket->socket_fd) == -1) { + pthread_mutex_unlock(&vhost_user.mutex); + goto again; + } + } else if (vsocket->reconnect) { + vhost_user_remove_reconnect(vsocket); + } + if (!strcmp(vsocket->path, path)) { pthread_mutex_lock(&vsocket->conn_mutex); for (conn = TAILQ_FIRST(&vsocket->conn_list); @@ -1056,21 +1070,8 @@ rte_vhost_driver_unregister(const char *path) pthread_mutex_unlock(&vsocket->conn_mutex); if (vsocket->is_server) { - /* - * If r/wcb is executing, release vhost_user's - * mutex lock, and try again since the r/wcb - * may use the mutex lock. - */ - if (fdset_try_del(&vhost_user.fdset, - vsocket->socket_fd) == -1) { - pthread_mutex_unlock(&vhost_user.mutex); - goto again; - } - close(vsocket->socket_fd); unlink(path); - } else if (vsocket->reconnect) { - vhost_user_remove_reconnect(vsocket); } pthread_mutex_destroy(&vsocket->conn_mutex);