[PATCH] net/memif: fix use after free on listener socket close

[David Marchand]

memif_socket_remove_device() calls rte_intr_callback_unregister() on
the listener socket interrupt handle. If memif_listener_handler() is
active at that point, the unregister returns -EAGAIN and the code
proceeds to close and free the handle while the handler is still
running.

Use rte_intr_callback_unregister_sync() which retries until the
handler completes.

Fixes: 7281511c2cfa ("net/memif: fix some interrupt FD leaks")

Signed-off-by: David Marchand <david.march...@redhat.com>
---
 drivers/net/memif/memif_socket.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/memif/memif_socket.c b/drivers/net/memif/memif_socket.c
index 971964133c..d672ad9f64 100644
--- a/drivers/net/memif/memif_socket.c
+++ b/drivers/net/memif/memif_socket.c
@@ -1198,8 +1198,8 @@ memif_socket_remove_device(struct rte_eth_dev *dev)
                                        socket->filename);
                }
                if (pmd->role != MEMIF_ROLE_CLIENT) {
-                       rte_intr_callback_unregister(socket->intr_handle, 
memif_listener_handler,
-                               socket);
+                       rte_intr_callback_unregister_sync(socket->intr_handle,
+                               memif_listener_handler, socket);
                        rte_intr_fd_close(socket->intr_handle);
                        rte_intr_instance_free(socket->intr_handle);
                }
-- 
2.56.0