Re: [PATCH] net/memif: fix use after free on listener socket close

[Stephen Hemminger <stephen@networkplumber.org>]

On Wed,  4 Nov 2026 17:41:53 +0100
David Marchand <david.marchand@redhat.com> wrote:

> memif_socket_remove_device() calls rte_intr_callback_unregister() on
> the listener socket interrupt handle. If memif_listener_handler() is
> active at that point, the unregister returns -EAGAIN and the code
> proceeds to close and free the handle while the handler is still
> running.
> 
> Use rte_intr_callback_unregister_sync() which retries until the
> handler completes.
> 
> Fixes: 7281511c2cfa ("net/memif: fix some interrupt FD leaks")
> 
> Signed-off-by: David Marchand <david.marchand@redhat.com>
> ---

Manually run AI review likes the patch but sees related pre-existing problem

Subject: Re: [PATCH] net/memif: fix use after free on listener socket close

On Wed,  4 Nov 2026 17:41:53 +0100
David Marchand <david.marchand@redhat.com> wrote:

> memif_socket_remove_device() calls rte_intr_callback_unregister() on
> the listener socket interrupt handle. If memif_listener_handler() is
> active at that point, the unregister returns -EAGAIN and the code
> proceeds to close and free the handle while the handler is still
> running.

The fix is correct. memif_socket_remove_device() is only reached from
memif_dev_close() in the primary, never from an interrupt callback,
so the _sync variant cannot spin on its own callback.

Info:

The same pattern is left in memif_socket_create_or_reuse(), on the
rte_hash_add_key_data() failure path. The listener callback was just
registered, so a client connecting in that window hits the same race.
Worth converting in the same patch:

	if (socket->listener) {
-		rte_intr_callback_unregister(socket->intr_handle,
-			memif_listener_handler, socket);
+		rte_intr_callback_unregister_sync(socket->intr_handle,
+			memif_listener_handler, socket);
		rte_intr_fd_close(socket->intr_handle);

Separate, pre-existing issue (not for this patch): control channels
accepted by memif_listener_handler() hold cc->socket but are not
tracked by the socket until memif_msg_receive_init() binds them to a
device. If the last device is closed while a client is between accept
and INIT, the socket is freed and the later INIT walks
cc->socket->dev_queue on freed memory. memif_socket_remove_device()
needs to disconnect pending control channels (or the socket needs a
list of them) before rte_free(socket).

Reviewed-by: Stephen Hemminger <stephen@networkplumber.org>