From: Marek Kasiewicz <[email protected]>

iavf_dev_close() unregisters iavf_dev_interrupt_handler() with
rte_intr_callback_unregister() and ignores the result. That call
returns -EAGAIN, and leaves the callback registered, while the
interrupt thread is running a callback of the same source.

Close hits that window. It sends virtchnl commands (RSS, promiscuous
mode, flows), and iavf_dev_interrupt_handler() handles each response.
The handler clears the pending command before it returns, so the
thread waiting in iavf_wait_for_msg() can go on to the unregister
while the interrupt thread is still inside the callback. This is
likely when the two threads share a CPU.

Two failures follow:
- The interrupt thread resumes the callback after
  rte_eth_dev_release_port() has set dev->data to NULL, and
  iavf_handle_virtchnl_msg() dereferences it: segmentation fault.
- The callback returns, but its source stays registered after the
  port is closed. At rte_eal_cleanup(),
  pci_vfio_unmap_resource_primary() closes the interrupt eventfd, and
  the next rebuild of the epoll set aborts the process:
    EAL: PANIC in eal_intr_thread_main():
    Error adding fd 49 epoll_ctl, Bad file descriptor

Use rte_intr_callback_unregister_sync(), as ice_dev_close() does. The
iavf_dev_init() error path has the same pattern; fix it too.

The sync variant waits for a running callback to return. It would
spin forever only if called from iavf_dev_interrupt_handler() itself,
and that handler never closes or re-initializes the port: it hands PF
events and resets to the iavf-event thread with iavf_dev_event_post().
A close from any other interrupt thread callback, such as an alarm,
returns at once, because the iavf source is not active then.

Fixes: 22b123a36d07 ("net/avf: initialize PMD")
Fixes: e35a5737a746 ("net/iavf: unregister interrupt handler before FD close")
Cc: [email protected]

Signed-off-by: Marek Kasiewicz <[email protected]>
Signed-off-by: Dawid Wesierski <[email protected]>
---
 drivers/net/intel/iavf/iavf_ethdev.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/net/intel/iavf/iavf_ethdev.c 
b/drivers/net/intel/iavf/iavf_ethdev.c
index 6cf12ec34f..be4b491859 100644
--- a/drivers/net/intel/iavf/iavf_ethdev.c
+++ b/drivers/net/intel/iavf/iavf_ethdev.c
@@ -3178,8 +3178,8 @@ iavf_dev_init(struct rte_eth_dev *eth_dev)
                rte_intr_disable(pci_dev->intr_handle);
 
                /* unregister callback func from eal lib */
-               rte_intr_callback_unregister(pci_dev->intr_handle,
-                                            iavf_dev_interrupt_handler, 
eth_dev);
+               rte_intr_callback_unregister_sync(pci_dev->intr_handle,
+                                                 iavf_dev_interrupt_handler, 
eth_dev);
        }
        iavf_phc_sync_alarm_stop(eth_dev);
        rte_eal_alarm_cancel(iavf_dev_alarm_handler, eth_dev);
@@ -3275,8 +3275,8 @@ iavf_dev_close(struct rte_eth_dev *dev)
                rte_intr_disable(intr_handle);
 
                /* unregister callback func from eal lib */
-               rte_intr_callback_unregister(intr_handle,
-                                            iavf_dev_interrupt_handler, dev);
+               rte_intr_callback_unregister_sync(intr_handle,
+                                                 iavf_dev_interrupt_handler, 
dev);
        }
        iavf_phc_sync_alarm_stop(dev);
        rte_eal_alarm_cancel(iavf_dev_alarm_handler, dev);

base-commit: b39ee12b030f49c524b9d8c350a0f4b04141ccf9
-- 
2.43.0

---------------------------------------------------------------------
Intel Technology Poland sp. z o.o.
ul. Slowackiego 173 | 80-298 Gdansk | Sad Rejonowy Gdansk Polnoc | VII Wydzial 
Gospodarczy Krajowego Rejestru Sadowego - KRS 101882 | NIP 957-07-52-316 | 
Kapital zakladowy 200.000 PLN.
Spolka oswiadcza, ze posiada status duzego przedsiebiorcy w rozumieniu ustawy z 
dnia 8 marca 2013 r. o przeciwdzialaniu nadmiernym opoznieniom w transakcjach 
handlowych.

Ta wiadomosc wraz z zalacznikami jest przeznaczona dla okreslonego adresata i 
moze zawierac informacje poufne. W razie przypadkowego otrzymania tej 
wiadomosci, prosimy o powiadomienie nadawcy oraz trwale jej usuniecie; 
jakiekolwiek przegladanie lub rozpowszechnianie jest zabronione.
This e-mail and any attachments may contain confidential material for the sole 
use of the intended recipient(s). If you are not the intended recipient, please 
contact the sender and delete all copies; any review or distribution by others 
is strictly prohibited.

Reply via email to