https://bugs.dpdk.org/show_bug.cgi?id=2032
Bug ID: 2032
Summary: bus/dpaa: crash when removing ethdev callbacks from a
non-EAL thread
Product: DPDK
Version: 24.11
Hardware: ARM
OS: Linux
Status: UNCONFIRMED
Severity: normal
Priority: Normal
Component: ethdev
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
DPDK version: 24.11.7
Environment:
- NXP LS1043A (aarch64)
- DPAA1 Ethernet device
- Two PMD threads
- Linux ANP 6.1.55-ASG1200-H #28 SMP PREEMPT Sun Sep 29 10:01:56 CST 2024
aarch64 GNU/Linux
- Packet capture implemented with ethdev RX/TX callbacks
- Callback registration and removal are performed by a non-PMD, non-EAL thread
Description:
The application crashes when a non-EAL thread removes ethdev RX/TX callbacks
that were registered for packet capture.
The capture thread registers callbacks with:
rte_eth_add_rx_callback(...);
rte_eth_add_tx_callback(...);
After the capture interval expires, the same non-EAL thread removes them with:
rte_eth_remove_rx_callback(...);
rte_eth_remove_tx_callback(...);
The crash occurs in dpaa_portal_finish() at:
dpaa_portals[rte_lcore_id()] = NULL;
Because the callback removal is executed from a non-EAL thread, rte_lcore_id()
returns LCORE_ID_ANY. This value is used as an index into dpaa_portals[],
causing an out-of-bounds access and a segmentation fault.
Steps to reproduce:
1. Start an application using a DPAA1 Ethernet device on LS1043A with two PMD
threads.
2. Start packet forwarding or packet processing.
3. From a non-EAL thread, register RX and TX callbacks for packet capture using
rte_eth_add_rx_callback() and rte_eth_add_tx_callback().
4. After a capture interval, remove the callbacks from the same thread using
rte_eth_remove_rx_callback() and rte_eth_remove_tx_callback().
5. Observe the application crash.
Actual result:
The application terminates with SIGSEGV in dpaa_portal_finish() because
LCORE_ID_ANY is used as an array index.
Expected result:
Removing ethdev callbacks from a non-EAL thread must not cause an out-of-bounds
array access or application crash.
Backtrace:
Program terminated with signal SIGSEGV, Segmentation fault.
#0 dpaa_portal_finish (arg=0x2184242e80)
at ../drivers/bus/dpaa/dpaa_bus.c:453
#1 0x0000ffff9283ed84 in ?? () from /lib64/libc.so.6
#2 0x0000ffff92841740 in ?? () from /lib64/libc.so.6
#3 0x0000ffff928976dc in ?? () from /lib64/libc.so.6
--
You are receiving this mail because:
You are the assignee for the bug.
