On Mon, May 2, 2022 at 9:23 PM Quentin Armitage <quen...@armitage.org.uk> wrote:
>
> rte_pmd_tun/tap_probe() allocates pmd->intr_handle in
> eth_dev_tap_create() and it should not be freed until
> rte_pmd_tap_remove() is called.
>
> Inspection of tap_rx_intr_vec_set() shows that the call to
> tap_tx_intr_vec_uninstall() was calling rte_intr_instance_free() but
> tap_tx_intr_vec_install() can then be immediately called, and this then
> uses pmd->intr_handle without it being reallocated.
>
> This commit moves the call of rte_intr_instance_free() from
> tap_tx_intr_vec_uninstall() to rte_pmd_tap_remove().
Good catch.
We want this fix backported:
Fixes: d61138d4f0e2 ("drivers: remove direct access to interrupt handle")
Cc: sta...@dpdk.org
>
> Signed-off-by: Quentin Armitage <quen...@armitage.org.uk>
> ---
> drivers/net/tap/rte_eth_tap.c | 5 +++++
> drivers/net/tap/tap_intr.c | 2 --
> 2 files changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/tap/rte_eth_tap.c b/drivers/net/tap/rte_eth_tap.c
> index bc3d56a311..aab1692ebf 100644
> --- a/drivers/net/tap/rte_eth_tap.c
> +++ b/drivers/net/tap/rte_eth_tap.c
> @@ -2612,14 +2612,19 @@ static int
> rte_pmd_tap_remove(struct rte_vdev_device *dev)
> {
> struct rte_eth_dev *eth_dev = NULL;
> + struct pmd_internals *pmd;
> + struct rte_intr_handle *intr_handle;
>
> /* find the ethdev entry */
> eth_dev = rte_eth_dev_allocated(rte_vdev_device_name(dev));
> if (!eth_dev)
> return 0;
>
> + pmd = eth_dev->data->dev_private;
> + intr_handle = pmd->intr_handle;
> tap_dev_close(eth_dev);
> rte_eth_dev_release_port(eth_dev);
> + rte_intr_instance_free(intr_handle);
intr_handle is shared for multiprocess, so freeing should happen in
the primary process only.
For this reason, rte_intr_instance_free() should probably go to tap_dev_close.
>
> return 0;
> }
> diff --git a/drivers/net/tap/tap_intr.c b/drivers/net/tap/tap_intr.c
> index 56c343acea..a9097def1a 100644
> --- a/drivers/net/tap/tap_intr.c
> +++ b/drivers/net/tap/tap_intr.c
> @@ -34,8 +34,6 @@ tap_rx_intr_vec_uninstall(struct rte_eth_dev *dev)
> rte_intr_free_epoll_fd(intr_handle);
> rte_intr_vec_list_free(intr_handle);
> rte_intr_nb_efd_set(intr_handle, 0);
> -
> - rte_intr_instance_free(intr_handle);
> }
>
> /**
> --
> 2.34.1
>
--
David Marchand
