From: Yehor Malikov <[email protected]>
The fdset_event_dispatch thread runs in a loop checking the destroy
flag after each epoll_wait iteration. During process exit,
rte_eal_cleanup() frees hugepage memory while the fdset thread is
still running. Since the fdset structure was allocated with
rte_zmalloc() (hugepage-backed), accessing it after rte_eal_cleanup()
causes use-after-free.
Switch fdset allocation from rte_zmalloc/rte_free to libc
calloc/free. The fdset is a control-path structure that does not
need hugepage memory. Using libc allocation ensures the fdset
remains valid after rte_eal_cleanup() releases hugepages.
Fixes: e68a6feaa3b3 ("vhost: improve fdset initialization")
Signed-off-by: Yehor Malikov <[email protected]>
---
.mailmap | 1 +
lib/vhost/fd_man.c | 7 ++++---
2 files changed, 5 insertions(+), 3 deletions(-)
diff --git a/.mailmap b/.mailmap
index fc53ed2a55..711a6ceff5 100644
--- a/.mailmap
+++ b/.mailmap
@@ -1840,6 +1840,7 @@ Yaroslav Brustinov <[email protected]>
Yash Sharma <[email protected]>
Yasufumi Ogawa <[email protected]> <[email protected]>
Yelena Krivosheev <[email protected]>
+Yehor Malikov <[email protected]>
Yerden Zhumabekov <[email protected]> <[email protected]>
Yevgeny Kliteynik <[email protected]>
Yi Chen <[email protected]>
diff --git a/lib/vhost/fd_man.c b/lib/vhost/fd_man.c
index f9147edee7..fae6d787b6 100644
--- a/lib/vhost/fd_man.c
+++ b/lib/vhost/fd_man.c
@@ -8,9 +8,10 @@
#include <sys/epoll.h>
#include <unistd.h>
+#include <stdlib.h>
+
#include <rte_common.h>
#include <rte_log.h>
-#include <rte_malloc.h>
#include <rte_string_fns.h>
#include <rte_thread.h>
@@ -94,7 +95,7 @@ fdset_init(const char *name)
return fdset;
}
- fdset = rte_zmalloc(NULL, sizeof(*fdset), 0);
+ fdset = calloc(1, sizeof(*fdset));
if (!fdset) {
VHOST_FDMAN_LOG(ERR, "failed to alloc fdset %s", name);
goto err_unlock;
@@ -142,7 +143,7 @@ fdset_init(const char *name)
err_epoll:
close(fdset->epfd);
err_free:
- rte_free(fdset);
+ free(fdset);
err_unlock:
pthread_mutex_unlock(&fdsets_mutex);
--
2.52.0
