[PATCH] net/iavf: fix interrupt callback race on close

[PATCH] net/iavf: fix interrupt callback race on close

[Dawid Wesierski]

From: Marek Kasiewicz <marek.kasiewicz@intel.com>

iavf_dev_close() unregisters iavf_dev_interrupt_handler() with
rte_intr_callback_unregister() and ignores the result. That call
returns -EAGAIN, and leaves the callback registered, while the
interrupt thread is running a callback of the same source.

Close hits that window. It sends virtchnl commands (RSS, promiscuous
mode, flows), and iavf_dev_interrupt_handler() handles each response.
The handler clears the pending command before it returns, so the
thread waiting in iavf_wait_for_msg() can go on to the unregister
while the interrupt thread is still inside the callback. This is
likely when the two threads share a CPU.

Two failures follow:
- The interrupt thread resumes the callback after
  rte_eth_dev_release_port() has set dev->data to NULL, and
  iavf_handle_virtchnl_msg() dereferences it: segmentation fault.
- The callback returns, but its source stays registered after the
  port is closed. At rte_eal_cleanup(),
  pci_vfio_unmap_resource_primary() closes the interrupt eventfd, and
  the next rebuild of the epoll set aborts the process:
    EAL: PANIC in eal_intr_thread_main():
    Error adding fd 49 epoll_ctl, Bad file descriptor

Use rte_intr_callback_unregister_sync(), as ice_dev_close() does. The
iavf_dev_init() error path has the same pattern; fix it too.

The sync variant waits for a running callback to return. It would
spin forever only if called from iavf_dev_interrupt_handler() itself,
and that handler never closes or re-initializes the port: it hands PF
events and resets to the iavf-event thread with iavf_dev_event_post().
A close from any other interrupt thread callback, such as an alarm,
returns at once, because the iavf source is not active then.

Fixes: 22b123a36d07 ("net/avf: initialize PMD")
Fixes: e35a5737a746 ("net/iavf: unregister interrupt handler before FD close")
Cc: stable@dpdk.org

Signed-off-by: Marek Kasiewicz <marek.kasiewicz@intel.com>
Signed-off-by: Dawid Wesierski <dawid.wesierski@intel.com>
---
 drivers/net/intel/iavf/iavf_ethdev.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/net/intel/iavf/iavf_ethdev.c b/drivers/net/intel/iavf/iavf_ethdev.c
index 6cf12ec34f..be4b491859 100644
--- a/drivers/net/intel/iavf/iavf_ethdev.c
+++ b/drivers/net/intel/iavf/iavf_ethdev.c
@@ -3178,8 +3178,8 @@ iavf_dev_init(struct rte_eth_dev *eth_dev)
 		rte_intr_disable(pci_dev->intr_handle);
 
 		/* unregister callback func from eal lib */
-		rte_intr_callback_unregister(pci_dev->intr_handle,
-					     iavf_dev_interrupt_handler, eth_dev);
+		rte_intr_callback_unregister_sync(pci_dev->intr_handle,
+						  iavf_dev_interrupt_handler, eth_dev);
 	}
 	iavf_phc_sync_alarm_stop(eth_dev);
 	rte_eal_alarm_cancel(iavf_dev_alarm_handler, eth_dev);
@@ -3275,8 +3275,8 @@ iavf_dev_close(struct rte_eth_dev *dev)
 		rte_intr_disable(intr_handle);
 
 		/* unregister callback func from eal lib */
-		rte_intr_callback_unregister(intr_handle,
-					     iavf_dev_interrupt_handler, dev);
+		rte_intr_callback_unregister_sync(intr_handle,
+						  iavf_dev_interrupt_handler, dev);
 	}
 	iavf_phc_sync_alarm_stop(dev);
 	rte_eal_alarm_cancel(iavf_dev_alarm_handler, dev);

base-commit: b39ee12b030f49c524b9d8c350a0f4b04141ccf9
-- 
2.43.0

---------------------------------------------------------------------
Intel Technology Poland sp. z o.o.
ul. Slowackiego 173 | 80-298 Gdansk | Sad Rejonowy Gdansk Polnoc | VII Wydzial Gospodarczy Krajowego Rejestru Sadowego - KRS 101882 | NIP 957-07-52-316 | Kapital zakladowy 200.000 PLN.
Spolka oswiadcza, ze posiada status duzego przedsiebiorcy w rozumieniu ustawy z dnia 8 marca 2013 r. o przeciwdzialaniu nadmiernym opoznieniom w transakcjach handlowych.

Ta wiadomosc wraz z zalacznikami jest przeznaczona dla okreslonego adresata i moze zawierac informacje poufne. W razie przypadkowego otrzymania tej wiadomosci, prosimy o powiadomienie nadawcy oraz trwale jej usuniecie; jakiekolwiek przegladanie lub rozpowszechnianie jest zabronione.
This e-mail and any attachments may contain confidential material for the sole use of the intended recipient(s). If you are not the intended recipient, please contact the sender and delete all copies; any review or distribution by others is strictly prohibited.

Re: [PATCH] net/iavf: fix interrupt callback race on close

[Dawid Wesierski]

Recheck-request: rebase=main, iol-compile-amd64-testing, iol-unit-amd64-testing

The failures come from the baseline, not from this patch. The Windows
clang build stops on -Wsign-compare in
drivers/net/intel/i40e/i40e_flow_fdir.c:901 and :948 of next-net-intel
b39ee12b030f. The current next-net-intel has a uint8_t raw_id there,
and this patch applies to it, and to main, with no change.
---------------------------------------------------------------------
Intel Technology Poland sp. z o.o.
ul. Slowackiego 173 | 80-298 Gdansk | Sad Rejonowy Gdansk Polnoc | VII Wydzial Gospodarczy Krajowego Rejestru Sadowego - KRS 101882 | NIP 957-07-52-316 | Kapital zakladowy 200.000 PLN.
Spolka oswiadcza, ze posiada status duzego przedsiebiorcy w rozumieniu ustawy z dnia 8 marca 2013 r. o przeciwdzialaniu nadmiernym opoznieniom w transakcjach handlowych.

Ta wiadomosc wraz z zalacznikami jest przeznaczona dla okreslonego adresata i moze zawierac informacje poufne. W razie przypadkowego otrzymania tej wiadomosci, prosimy o powiadomienie nadawcy oraz trwale jej usuniecie; jakiekolwiek przegladanie lub rozpowszechnianie jest zabronione.
This e-mail and any attachments may contain confidential material for the sole use of the intended recipient(s). If you are not the intended recipient, please contact the sender and delete all copies; any review or distribution by others is strictly prohibited.

Re: [PATCH] net/iavf: fix interrupt callback race on close

[Bruce Richardson]

On Wed, Oct 14, 2026 at 12:24:27PM +0000, Dawid Wesierski wrote:
> From: Marek Kasiewicz <marek.kasiewicz@intel.com>
> 
> iavf_dev_close() unregisters iavf_dev_interrupt_handler() with
> rte_intr_callback_unregister() and ignores the result. That call
> returns -EAGAIN, and leaves the callback registered, while the
> interrupt thread is running a callback of the same source.
> 
> Close hits that window. It sends virtchnl commands (RSS, promiscuous
> mode, flows), and iavf_dev_interrupt_handler() handles each response.
> The handler clears the pending command before it returns, so the
> thread waiting in iavf_wait_for_msg() can go on to the unregister
> while the interrupt thread is still inside the callback. This is
> likely when the two threads share a CPU.
> 
> Two failures follow:
> - The interrupt thread resumes the callback after
>   rte_eth_dev_release_port() has set dev->data to NULL, and
>   iavf_handle_virtchnl_msg() dereferences it: segmentation fault.
> - The callback returns, but its source stays registered after the
>   port is closed. At rte_eal_cleanup(),
>   pci_vfio_unmap_resource_primary() closes the interrupt eventfd, and
>   the next rebuild of the epoll set aborts the process:
>     EAL: PANIC in eal_intr_thread_main():
>     Error adding fd 49 epoll_ctl, Bad file descriptor
> 
> Use rte_intr_callback_unregister_sync(), as ice_dev_close() does. The
> iavf_dev_init() error path has the same pattern; fix it too.
> 
> The sync variant waits for a running callback to return. It would
> spin forever only if called from iavf_dev_interrupt_handler() itself,
> and that handler never closes or re-initializes the port: it hands PF
> events and resets to the iavf-event thread with iavf_dev_event_post().
> A close from any other interrupt thread callback, such as an alarm,
> returns at once, because the iavf source is not active then.
> 
> Fixes: 22b123a36d07 ("net/avf: initialize PMD")
> Fixes: e35a5737a746 ("net/iavf: unregister interrupt handler before FD close")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Marek Kasiewicz <marek.kasiewicz@intel.com>
> Signed-off-by: Dawid Wesierski <dawid.wesierski@intel.com>
> ---
>  drivers/net/intel/iavf/iavf_ethdev.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
> 
Acked-by: Bruce Richardson <bruce.richardson@intel.com>

Patch applied to dpdk-next-net-intel.
Thanks,
/Bruce