Re: [PATCH dpdk] graph: fix use-after-free when updating edges with active graphs

[Thomas Monjalon <thomas@monjalon.net>]

10/11/2025 09:50, Jerin Jacob:
> On Sat, Nov 1, 2025 at 3:43 AM Robin Jarry <rjarry@redhat.com> wrote:
> >
> > After creating at least one graph and calling rte_node_edge_update to
> > add a new edge on a node which is in use in the graph, the node memory
> > is reallocated but the active graph still has a pointer to the freed
> > memory.
> >
> > When destroying the graph, it causes a use-after-free error detected by
> > libasan:
> >
> > ERROR: AddressSanitizer: heap-use-after-free
> > READ of size 8 at 0x7c4baa5e4da8 thread T0
> >     #0 0x0000005ad224 in graph_node_fini lib/graph/graph.c:256
> >     #1 0x0000005ae657 in rte_graph_destroy lib/graph/graph.c:504
> >     ...
> >
> > freed by thread T0 here:
> >     #0 0x7f1bac4e5e4b in realloc.part.0 (/lib64/libasan.so.8+0xe5e4b)
> >     #1 0x0000005ab6d7 in edge_update lib/graph/node.c:271
> >     #2 0x0000005abb1b in rte_node_edge_update lib/graph/node.c:339
> >     ...
> >
> > previously allocated by thread T0 here:
> >     #0 0x7f1bac4e5e4b in realloc.part.0 (/lib64/libasan.so.8+0xe5e4b)
> >     #1 0x0000005ab6d7 in edge_update lib/graph/node.c:271
> >     #2 0x0000005abb1b in rte_node_edge_update lib/graph/node.c:339
> >     ...
> >
> > Use malloc+memcpy and add an internal function to replace all references
> > to the old node memory before freeing it.
> >
> > Cc: stable@dpdk.org
> > Fixes: c59dac2ca14a ("graph: implement node operations")
> >
> > Signed-off-by: Robin Jarry <rjarry@redhat.com>
> 
> Acked-by: Jerin Jacob <jerinj@marvell.com>

Applied, thanks.