On Wed, 4 Nov 2026 17:41:53 +0100
David Marchand <[email protected]> wrote:
> memif_socket_remove_device() calls rte_intr_callback_unregister() on
> the listener socket interrupt handle. If memif_listener_handler() is
> active at that point, the unregister returns -EAGAIN and the code
> proceeds to close and free the handle while the handler is still
> running.
>
> Use rte_intr_callback_unregister_sync() which retries until the
> handler completes.
>
> Fixes: 7281511c2cfa ("net/memif: fix some interrupt FD leaks")
>
> Signed-off-by: David Marchand <[email protected]>
> ---
Manually run AI review likes the patch but sees related pre-existing problem
Subject: Re: [PATCH] net/memif: fix use after free on listener socket close
On Wed, 4 Nov 2026 17:41:53 +0100
David Marchand <[email protected]> wrote:
> memif_socket_remove_device() calls rte_intr_callback_unregister() on
> the listener socket interrupt handle. If memif_listener_handler() is
> active at that point, the unregister returns -EAGAIN and the code
> proceeds to close and free the handle while the handler is still
> running.
The fix is correct. memif_socket_remove_device() is only reached from
memif_dev_close() in the primary, never from an interrupt callback,
so the _sync variant cannot spin on its own callback.
Info:
The same pattern is left in memif_socket_create_or_reuse(), on the
rte_hash_add_key_data() failure path. The listener callback was just
registered, so a client connecting in that window hits the same race.
Worth converting in the same patch:
if (socket->listener) {
- rte_intr_callback_unregister(socket->intr_handle,
- memif_listener_handler, socket);
+ rte_intr_callback_unregister_sync(socket->intr_handle,
+ memif_listener_handler, socket);
rte_intr_fd_close(socket->intr_handle);
Separate, pre-existing issue (not for this patch): control channels
accepted by memif_listener_handler() hold cc->socket but are not
tracked by the socket until memif_msg_receive_init() binds them to a
device. If the last device is closed while a client is between accept
and INIT, the socket is freed and the later INIT walks
cc->socket->dev_queue on freed memory. memif_socket_remove_device()
needs to disconnect pending control channels (or the socket needs a
list of them) before rte_free(socket).
Reviewed-by: Stephen Hemminger <[email protected]>
