Skip to content

Commit c8d5852

Browse files
committed
control_output: fix use-after-free on shutdown
Since commit e954453 ("control-output: prevent use-after-free on object deletion"), deleting interfaces or nexthops causes a call to control_output_poll() in order to drain the packets that may reference the deleted object. On shutdown, the modules finalization order causes control_output to be finalized before the iface module. When the iface module is finalized, all remaining interfaces are deleted and control_output_poll() accesses the ring that was already "freed". ERROR: AddressSanitizer: heap-use-after-free on address 0x00016d19d608 at pc 0x00000045901c bp 0xffffca318bd0 sp 0xffffca318be8 READ of size 4 at 0x00016d19d608 thread T0 #0 0x000000459018 in rte_ring_dequeue_bulk_elem ../subprojects/dpdk/lib/ring/rte_ring_elem.h:375 #1 0x000000459018 in rte_ring_dequeue_elem ../subprojects/dpdk/lib/ring/rte_ring_elem.h:471 #2 0x000000459018 in rte_ring_dequeue ../subprojects/dpdk/lib/ring/rte_ring.h:496 #3 0x000000459018 in control_output_poll ../modules/infra/control/control_output.c:33 #4 0x0000004648a0 in event_handler ../modules/infra/control/control_output.c:76 #5 0x000000416974 in gr_event_push ../main/event.c:26 #6 0x00000046a930 in iface_destroy ../modules/infra/control/iface.c:424 #7 0x00000046b138 in iface_fini ../modules/infra/control/iface.c:462 #8 0x00000041d63c in modules_fini ../main/module.c:112 #9 0x00000041b5a4 in main ../main/main.c:326 Ensure both iface and nexthop are finalized before control_output. Fixes: e954453 ("control-output: prevent use-after-free on object deletion") Signed-off-by: Robin Jarry <rjarry@redhat.com>
1 parent 6b93131 commit c8d5852

3 files changed

Lines changed: 2 additions & 3 deletions

File tree

modules/infra/control/graph.c

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -579,7 +579,6 @@ static void graph_fini(struct event_base *) {
579579

580580
static struct gr_module graph_module = {
581581
.name = "graph",
582-
.depends_on = "iface",
583582
.init = graph_init,
584583
.fini = graph_fini,
585584
};

modules/infra/control/iface.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -469,7 +469,7 @@ static void iface_fini(struct event_base *) {
469469

470470
static struct gr_module iface_module = {
471471
.name = "iface",
472-
.depends_on = "*route",
472+
.depends_on = "*route,control_output",
473473
.init = iface_init,
474474
.fini = iface_fini,
475475
};

modules/infra/control/nexthop.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -693,7 +693,7 @@ static struct gr_event_serializer nh_serializer = {
693693

694694
static struct gr_module module = {
695695
.name = "nexthop",
696-
.depends_on = "rcu",
696+
.depends_on = "rcu,control_output",
697697
.init = nh_init,
698698
.fini = nh_fini,
699699
};

0 commit comments

Comments
 (0)