Re: [PATCH v1 1/1] net/nbl: fix use-after-free

[Stephen Hemminger <stephen@networkplumber.org>]

On Wed, 26 Aug 2026 13:05:27 +0100
Anatoly Burakov <anatoly.burakov@intel.com> wrote:

> When unmapping a device, the device is not removed from TAILQ, which may
> result in attempting to access this devices' data during subsequent mem
> event callbacks (as they are only disabled once all devices are removed).
> 
> Remove the device from TAILQ on unmap to fix it.
> 
> Fixes: dc955cd24c8f ("net/nbl: add coexistence mode")
> Cc: dimon.zhao@nebula-matrix.com
> Cc: stable@dpdk.org
> 
> Signed-off-by: Anatoly Burakov <anatoly.burakov@intel.com>
> ---

AI review found another race; the close needs to happen after the
removal. Like this:


From d138d13ad3bc03d0b032aba593283f49ffa64b97 Mon Sep 17 00:00:00 2001
From: Anatoly Burakov <anatoly.burakov@intel.com>
Date: Wed, 26 Aug 2026 13:05:27 +0100
Subject: [PATCH] net/nbl: fix use-after-free

When unmapping a device, the device is not removed from TAILQ, which may
result in attempting to access this devices' data during subsequent mem
event callbacks (as they are only disabled once all devices are removed).

Remove the device from TAILQ on unmap to fix it, and close the device
fd under the same lock so a callback cannot use a stale fd number.

Fixes: dc955cd24c8f ("net/nbl: add coexistence mode")
Cc: dimon.zhao@nebula-matrix.com
Cc: stable@dpdk.org

Signed-off-by: Anatoly Burakov <anatoly.burakov@intel.com>
---
 drivers/net/nbl/nbl_common/nbl_userdev.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/nbl/nbl_common/nbl_userdev.c b/drivers/net/nbl/nbl_common/nbl_userdev.c
index 96f0d2e264..ec6840d60e 100644
--- a/drivers/net/nbl/nbl_common/nbl_userdev.c
+++ b/drivers/net/nbl/nbl_common/nbl_userdev.c
@@ -547,8 +547,9 @@ static int nbl_mdev_unmap_device(struct nbl_adapter *adapter)
 	struct nbl_common_info *common = &adapter->common;
 	int vfio_group_fd, ret;
 
-	close(common->devfd);
 	rte_mcfg_mem_read_lock();
+	TAILQ_REMOVE(&nbl_adapter_list, adapter, next);
+	close(common->devfd);
 	vfio_group_fd = rte_vfio_container_group_bind(nbl_default_container,
 						      common->iommu_group_num);
 	NBL_LOG(DEBUG, "close vfio_group_fd %d", vfio_group_fd);
-- 
2.53.0