From: Robert Sanford <[email protected]> A thread walking the mempool list with rte_mempool_walk(), rte_mempool_lookup() or rte_mempool_list_dump() can crash while other threads create and free mempools. We hit this in production, in a process that walks the mempools while other threads create and free them.
There are two races: - rte_mempool_free() unlinks and frees the list entry without the mempool list lock that the walkers hold, so a walker can reach a freed entry or mempool. Patch 1 takes the lock in rte_mempool_free(), as rte_mempool_create_empty() already does. A rte_mempool_walk() callback can therefore no longer free a mempool; this is documented. - A mempool is on the list before its store exists, and walking or dumping it reads the store. Patch 2 skips mempools without RTE_MEMPOOL_F_POOL_CREATED in rte_mempool_walk() and rte_mempool_list_dump(). The release/acquire fences it adds generate no instructions on x86. Patch 3 adds a test to mempool_autotest. On x86 with 4 or 8 lcores, it crashed in all 20 runs without patch 1, without patch 2, or without both, and passed in all 20 runs with both patches. Robert Sanford (3): mempool: fix race between list walk and free mempool: skip unpopulated pools in walk and dump test/mempool: add list walk race test app/test/test_mempool.c | 137 ++++++++++++++++++++++++++++++++++++++ lib/mempool/rte_mempool.c | 28 +++++++- lib/mempool/rte_mempool.h | 6 ++ 3 files changed, 170 insertions(+), 1 deletion(-) -- 2.34.1
