[PATCH v2] net/memif: fix use after free on listener socket close

[David Marchand <david.marchand@redhat.com>]

memif_socket_remove_device() calls rte_intr_callback_unregister() on
the listener socket interrupt handle. If memif_listener_handler() is
active at that point, the unregister returns -EAGAIN and the code
proceeds to close and free the handle while the handler is still
running.

Use rte_intr_callback_unregister_sync() which retries until the
handler completes.

Fixes: 7281511c2cfa ("net/memif: fix some interrupt FD leaks")

Signed-off-by: David Marchand <david.marchand@redhat.com>
Reviewed-by: Stephen Hemminger <stephen@networkplumber.org>
---
Changes since v1:
- added missing _sync in other call,

---
 drivers/net/memif/memif_socket.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/memif/memif_socket.c b/drivers/net/memif/memif_socket.c
index 971964133c..b3cd84bf21 100644
--- a/drivers/net/memif/memif_socket.c
+++ b/drivers/net/memif/memif_socket.c
@@ -1126,7 +1126,7 @@ memif_socket_init(struct rte_eth_dev *dev, const char *socket_filename)
 		if (ret < 0) {
 			MIF_LOG(ERR, "Failed to add socket to socket hash.");
 			if (socket->listener) {
-				rte_intr_callback_unregister(socket->intr_handle,
+				rte_intr_callback_unregister_sync(socket->intr_handle,
 					memif_listener_handler, socket);
 				rte_intr_fd_close(socket->intr_handle);
 				rte_intr_instance_free(socket->intr_handle);
@@ -1198,8 +1198,8 @@ memif_socket_remove_device(struct rte_eth_dev *dev)
 					socket->filename);
 		}
 		if (pmd->role != MEMIF_ROLE_CLIENT) {
-			rte_intr_callback_unregister(socket->intr_handle, memif_listener_handler,
-				socket);
+			rte_intr_callback_unregister_sync(socket->intr_handle,
+				memif_listener_handler, socket);
 			rte_intr_fd_close(socket->intr_handle);
 			rte_intr_instance_free(socket->intr_handle);
 		}
-- 
2.56.0