[PATCH v1 0/3] mempool: fix races between list walk and create/free

[Robert Sanford <rsanford2@gmail.com>]

From: Robert Sanford <rsanford@akamai.com>

A thread walking the mempool list with rte_mempool_walk(),
rte_mempool_lookup() or rte_mempool_list_dump() can crash while other
threads create and free mempools. We hit this in production, in a
process that walks the mempools while other threads create and free
them.

There are two races:

- rte_mempool_free() unlinks and frees the list entry without the
  mempool list lock that the walkers hold, so a walker can reach a
  freed entry or mempool. Patch 1 takes the lock in rte_mempool_free(),
  as rte_mempool_create_empty() already does. A rte_mempool_walk()
  callback can therefore no longer free a mempool; this is documented.

- A mempool is on the list before its store exists, and walking or
  dumping it reads the store. Patch 2 skips mempools without
  RTE_MEMPOOL_F_POOL_CREATED in rte_mempool_walk() and
  rte_mempool_list_dump(). The release/acquire fences it adds generate
  no instructions on x86.

Patch 3 adds a test to mempool_autotest. On x86 with 4 or 8 lcores,
it crashed in all 20 runs without patch 1, without patch 2, or
without both, and passed in all 20 runs with both patches.

Robert Sanford (3):
  mempool: fix race between list walk and free
  mempool: skip unpopulated pools in walk and dump
  test/mempool: add list walk race test

 app/test/test_mempool.c   | 137 ++++++++++++++++++++++++++++++++++++++
 lib/mempool/rte_mempool.c |  28 +++++++-
 lib/mempool/rte_mempool.h |   6 ++
 3 files changed, 170 insertions(+), 1 deletion(-)

-- 
2.34.1