memif_socket_remove_device() calls rte_intr_callback_unregister() on
the listener socket interrupt handle. If memif_listener_handler() is
active at that point, the unregister returns -EAGAIN and the code
proceeds to close and free the handle while the handler is still
running.

Use rte_intr_callback_unregister_sync() which retries until the
handler completes.

Fixes: 7281511c2cfa ("net/memif: fix some interrupt FD leaks")

Signed-off-by: David Marchand <[email protected]>
Reviewed-by: Stephen Hemminger <[email protected]>
---
Changes since v1:
- added missing _sync in other call,

---
 drivers/net/memif/memif_socket.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/memif/memif_socket.c b/drivers/net/memif/memif_socket.c
index 971964133c..b3cd84bf21 100644
--- a/drivers/net/memif/memif_socket.c
+++ b/drivers/net/memif/memif_socket.c
@@ -1126,7 +1126,7 @@ memif_socket_init(struct rte_eth_dev *dev, const char 
*socket_filename)
                if (ret < 0) {
                        MIF_LOG(ERR, "Failed to add socket to socket hash.");
                        if (socket->listener) {
-                               
rte_intr_callback_unregister(socket->intr_handle,
+                               
rte_intr_callback_unregister_sync(socket->intr_handle,
                                        memif_listener_handler, socket);
                                rte_intr_fd_close(socket->intr_handle);
                                rte_intr_instance_free(socket->intr_handle);
@@ -1198,8 +1198,8 @@ memif_socket_remove_device(struct rte_eth_dev *dev)
                                        socket->filename);
                }
                if (pmd->role != MEMIF_ROLE_CLIENT) {
-                       rte_intr_callback_unregister(socket->intr_handle, 
memif_listener_handler,
-                               socket);
+                       rte_intr_callback_unregister_sync(socket->intr_handle,
+                               memif_listener_handler, socket);
                        rte_intr_fd_close(socket->intr_handle);
                        rte_intr_instance_free(socket->intr_handle);
                }
-- 
2.56.0

Reply via email to