Coverity reports a data race where netdev_dpdk_vhost_destruct()
accesses vhost_driver_flags without holding dpdk_mutex, while
netdev_dpdk_vhost_client_reconfigure() writes to vhost_driver_flags
with the mutex held (as is done 4 out of 4 times when writing).
This could cause a race if another thread modifies vhost_driver_flags
through netdev_dpdk_vhost_client_reconfigure() at the same time the
destructor is running, potentially leading to incorrect socket cleanup.
Fix by capturing the flag value while holding dpdk_mutex, similar to how
vhost_id is already handled.
Fixes: c1ff66ac80b5 ("netdev-dpdk: vHost client mode and reconnect")
Signed-off-by: Eelco Chaudron <[email protected]>
---
lib/netdev-dpdk.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/lib/netdev-dpdk.c b/lib/netdev-dpdk.c
index 923191da8..b5d72283c 100644
--- a/lib/netdev-dpdk.c
+++ b/lib/netdev-dpdk.c
@@ -1822,6 +1822,7 @@ static void
netdev_dpdk_vhost_destruct(struct netdev *netdev)
{
struct netdev_dpdk *dev = netdev_dpdk_cast(netdev);
+ bool is_client_mode;
char *vhost_id;
ovs_mutex_lock(&dpdk_mutex);
@@ -1836,6 +1837,7 @@ netdev_dpdk_vhost_destruct(struct netdev *netdev)
}
vhost_id = dev->vhost_id;
+ is_client_mode = dev->vhost_driver_flags & RTE_VHOST_USER_CLIENT;
dev->vhost_id = NULL;
rte_free(dev->vhost_rxq_enabled);
@@ -1850,7 +1852,7 @@ netdev_dpdk_vhost_destruct(struct netdev *netdev)
if (dpdk_vhost_driver_unregister(dev, vhost_id)) {
VLOG_ERR("%s: Unable to unregister vhost driver for socket '%s'.\n",
netdev->name, vhost_id);
- } else if (!(dev->vhost_driver_flags & RTE_VHOST_USER_CLIENT)) {
+ } else if (!is_client_mode) {
/* OVS server mode - remove this socket from list for deletion */
fatal_signal_remove_file_to_unlink(vhost_id);
}
--
2.52.0
_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
