On Sat, Nov 1, 2025 at 3:43 AM Robin Jarry <[email protected]> wrote: > > After creating at least one graph and calling rte_node_edge_update to > add a new edge on a node which is in use in the graph, the node memory > is reallocated but the active graph still has a pointer to the freed > memory. > > When destroying the graph, it causes a use-after-free error detected by > libasan: > > ERROR: AddressSanitizer: heap-use-after-free > READ of size 8 at 0x7c4baa5e4da8 thread T0 > #0 0x0000005ad224 in graph_node_fini lib/graph/graph.c:256 > #1 0x0000005ae657 in rte_graph_destroy lib/graph/graph.c:504 > ... > > freed by thread T0 here: > #0 0x7f1bac4e5e4b in realloc.part.0 (/lib64/libasan.so.8+0xe5e4b) > #1 0x0000005ab6d7 in edge_update lib/graph/node.c:271 > #2 0x0000005abb1b in rte_node_edge_update lib/graph/node.c:339 > ... > > previously allocated by thread T0 here: > #0 0x7f1bac4e5e4b in realloc.part.0 (/lib64/libasan.so.8+0xe5e4b) > #1 0x0000005ab6d7 in edge_update lib/graph/node.c:271 > #2 0x0000005abb1b in rte_node_edge_update lib/graph/node.c:339 > ... > > Use malloc+memcpy and add an internal function to replace all references > to the old node memory before freeing it. > > Cc: [email protected] > Fixes: c59dac2ca14a ("graph: implement node operations")
Acked-by: Jerin Jacob <[email protected]> > > Signed-off-by: Robin Jarry <[email protected]> > --- > lib/graph/graph.c | 14 ++++++++++++++ > lib/graph/graph_private.h | 12 ++++++++++++ > lib/graph/node.c | 6 +++++- > 3 files changed, 31 insertions(+), 1 deletion(-) > > diff --git a/lib/graph/graph.c b/lib/graph/graph.c > index 61159edc7261..6911ea8abeed 100644 > --- a/lib/graph/graph.c > +++ b/lib/graph/graph.c > @@ -277,6 +277,20 @@ graph_node_fini(struct graph *graph) > > graph_node->node->name)); > } > > +void > +graph_node_replace_all(struct node *old, struct node *new) > +{ > + struct graph_node *graph_node; > + struct graph *graph; > + > + STAILQ_FOREACH(graph, &graph_list, next) { > + STAILQ_FOREACH(graph_node, &graph->node_list, next) { > + if (graph_node->node == old) > + graph_node->node = new; > + } > + } > +} > + > static struct rte_graph * > graph_mem_fixup_node_ctx(struct rte_graph *graph) > { > diff --git a/lib/graph/graph_private.h b/lib/graph/graph_private.h > index 21912c0ae63f..26cdc6637192 100644 > --- a/lib/graph/graph_private.h > +++ b/lib/graph/graph_private.h > @@ -299,6 +299,18 @@ int graph_node_has_edge_to_src_node(struct graph *graph); > */ > int graph_node_has_loop_edge(struct graph *graph); > > +/** > + * @internal > + * > + * Replace all pointers of a given node with another one in all active > graphs. > + * > + * @param old > + * Node pointer to replace in all graphs. > + * @param new > + * Updated pointer. > + */ > +void graph_node_replace_all(struct node *old, struct node *new); > + > /** > * @internal > * > diff --git a/lib/graph/node.c b/lib/graph/node.c > index cae1c809edc4..e3359fe490a5 100644 > --- a/lib/graph/node.c > +++ b/lib/graph/node.c > @@ -325,11 +325,15 @@ edge_update(struct node *node, struct node *prev, > rte_edge_t from, > need_realloc = max_edges > node->nb_edges; > if (need_realloc) { > sz = sizeof(struct node) + (max_edges * RTE_NODE_NAMESIZE); > - new_node = realloc(node, sz); > + new_node = malloc(sz); > if (new_node == NULL) { > rte_errno = ENOMEM; > goto restore; > } else { > + sz = sizeof(*node) + (node->nb_edges * > RTE_NODE_NAMESIZE); > + memcpy(new_node, node, sz); > + graph_node_replace_all(node, new_node); > + free(node); > node = new_node; > } > } > -- > 2.51.1 >
