[PATCH 1/1] tap: fix write-after-free and double free of intr_handle

[Quentin Armitage]

rte_pmd_tun/tap_probe() allocates pmd->intr_handle in
eth_dev_tap_create() and it should not be freed until
rte_pmd_tap_remove() is called.

Inspection of tap_rx_intr_vec_set() shows that the call to
tap_tx_intr_vec_uninstall() was calling rte_intr_instance_free() but
tap_tx_intr_vec_install() can then be immediately called, and this then
uses pmd->intr_handle without it being reallocated.

This commit moves the call of rte_intr_instance_free() from
tap_tx_intr_vec_uninstall() to rte_pmd_tap_remove().

Signed-off-by: Quentin Armitage <quen...@armitage.org.uk>
---
 drivers/net/tap/rte_eth_tap.c | 5 +++++
 drivers/net/tap/tap_intr.c    | 2 --
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/net/tap/rte_eth_tap.c b/drivers/net/tap/rte_eth_tap.c
index bc3d56a311..aab1692ebf 100644
--- a/drivers/net/tap/rte_eth_tap.c
+++ b/drivers/net/tap/rte_eth_tap.c
@@ -2612,14 +2612,19 @@ static int
 rte_pmd_tap_remove(struct rte_vdev_device *dev)
 {
        struct rte_eth_dev *eth_dev = NULL;
+       struct pmd_internals *pmd;
+       struct rte_intr_handle *intr_handle;
 
        /* find the ethdev entry */
        eth_dev = rte_eth_dev_allocated(rte_vdev_device_name(dev));
        if (!eth_dev)
                return 0;
 
+       pmd = eth_dev->data->dev_private;
+       intr_handle = pmd->intr_handle;
        tap_dev_close(eth_dev);
        rte_eth_dev_release_port(eth_dev);
+       rte_intr_instance_free(intr_handle);
 
        return 0;
 }
diff --git a/drivers/net/tap/tap_intr.c b/drivers/net/tap/tap_intr.c
index 56c343acea..a9097def1a 100644
--- a/drivers/net/tap/tap_intr.c
+++ b/drivers/net/tap/tap_intr.c
@@ -34,8 +34,6 @@ tap_rx_intr_vec_uninstall(struct rte_eth_dev *dev)
        rte_intr_free_epoll_fd(intr_handle);
        rte_intr_vec_list_free(intr_handle);
        rte_intr_nb_efd_set(intr_handle, 0);
-
-       rte_intr_instance_free(intr_handle);
 }
 
 /**
-- 
2.34.1