d/numam-dpdk
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

bus/pci: fix use after free on unplug

Browse Source 
rte_pci_unmap_device() needs intr_handle objects to unregister
callbacks.

Bugzilla ID: 845
Fixes: d61138d4f0e2 ("drivers: remove direct access to interrupt handle")

Signed-off-by: David Marchand <david.marchand@redhat.com>
Tested-by: Yan Xia <yanx.xia@intel.com>
Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>
This commit is contained in:
David Marchand 2021-11-03 12:16:15 +01:00
parent 5633173341
commit f2777b53b1
1 changed files with 9 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
drivers/bus/pci/pci_common.c
View File

@ -271,10 +271,6 @@ rte_pci_probe_one_driver(struct rte_pci_driver *dr,
return ret; /* no rollback if already succeeded earlier */
if (ret) {
dev->driver = NULL;
rte_intr_instance_free(dev->vfio_req_intr_handle);
dev->vfio_req_intr_handle = NULL;
rte_intr_instance_free(dev->intr_handle);
dev->intr_handle = NULL;
if ((dr->drv_flags & RTE_PCI_DRV_NEED_MAPPING) &&
/* Don't unmap if device is unsupported and
* driver needs mapped resources.
@ -282,6 +278,10 @@ rte_pci_probe_one_driver(struct rte_pci_driver *dr,
!(ret > 0 &&
(dr->drv_flags & RTE_PCI_DRV_KEEP_MAPPED_RES)))
rte_pci_unmap_device(dev);
rte_intr_instance_free(dev->vfio_req_intr_handle);
dev->vfio_req_intr_handle = NULL;
rte_intr_instance_free(dev->intr_handle);
dev->intr_handle = NULL;
} else {
dev->device.driver = &dr->driver;
}
@ -322,15 +322,16 @@ rte_pci_detach_dev(struct rte_pci_device *dev)
/* clear driver structure */
dev->driver = NULL;
dev->device.driver = NULL;
rte_intr_instance_free(dev->intr_handle);
dev->intr_handle = NULL;
rte_intr_instance_free(dev->vfio_req_intr_handle);
dev->vfio_req_intr_handle = NULL;
if (dr->drv_flags & RTE_PCI_DRV_NEED_MAPPING)
/* unmap resources for devices that use igb_uio */
rte_pci_unmap_device(dev);
rte_intr_instance_free(dev->intr_handle);
dev->intr_handle = NULL;
rte_intr_instance_free(dev->vfio_req_intr_handle);
dev->vfio_req_intr_handle = NULL;
return 0;
}