[PATCH] net/memif: fix use after free on listener socket close

[David Marchand <david.marchand@redhat.com>]

memif_socket_remove_device() calls rte_intr_callback_unregister() on
the listener socket interrupt handle. If memif_listener_handler() is
active at that point, the unregister returns -EAGAIN and the code
proceeds to close and free the handle while the handler is still
running.

Use rte_intr_callback_unregister_sync() which retries until the
handler completes.

Fixes: 7281511c2cfa ("net/memif: fix some interrupt FD leaks")

Signed-off-by: David Marchand <david.marchand@redhat.com>
---
 drivers/net/memif/memif_socket.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/memif/memif_socket.c b/drivers/net/memif/memif_socket.c
index 971964133c..d672ad9f64 100644
--- a/drivers/net/memif/memif_socket.c
+++ b/drivers/net/memif/memif_socket.c
@@ -1198,8 +1198,8 @@ memif_socket_remove_device(struct rte_eth_dev *dev)
 					socket->filename);
 		}
 		if (pmd->role != MEMIF_ROLE_CLIENT) {
-			rte_intr_callback_unregister(socket->intr_handle, memif_listener_handler,
-				socket);
+			rte_intr_callback_unregister_sync(socket->intr_handle,
+				memif_listener_handler, socket);
 			rte_intr_fd_close(socket->intr_handle);
 			rte_intr_instance_free(socket->intr_handle);
 		}
-- 
2.56.0