* [Bug 189] RTE Timer Adapter Use After Free
@ 2019-01-15 11:27 bugzilla
0 siblings, 0 replies; only message in thread
From: bugzilla @ 2019-01-15 11:27 UTC (permalink / raw)
To: dev
https://bugs.dpdk.org/show_bug.cgi?id=189
Bug ID: 189
Summary: RTE Timer Adapter Use After Free
Product: DPDK
Version: 19.02
Hardware: All
OS: All
Status: CONFIRMED
Severity: normal
Priority: Normal
Component: eventdev
Assignee: dev@dpdk.org
Reporter: mattias.ronnblom@ericsson.com
Target Milestone: ---
Upon event timer expiry, the timer adapter will cause the timer struct to be
used after its freed.
rte_event_timer_adapter.c:sw_event_timer_cb() calls rte_mempool_put(),
returning the internal timer-related data, including a rte_timer instance, to
the pool.
rte_timer_manage() updates fields of the rte_timer struct *after* the expiry
call back has finished.
Timers armed on a different core may retrieve this timer struct from the pool,
resulting in a data race.
--
You are receiving this mail because:
You are the assignee for the bug.
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2019-01-15 11:27 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-01-15 11:27 [Bug 189] RTE Timer Adapter Use After Free bugzilla
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.