[PATCH dpdk] graph: fix use-after-free when updating edges with active graphs

[Jerin Jacob]

On Sat, Nov 1, 2025 at 3:43 AM Robin Jarry <rjarry at redhat.com> wrote:
>
> After creating at least one graph and calling rte_node_edge_update to
> add a new edge on a node which is in use in the graph, the node memory
> is reallocated but the active graph still has a pointer to the freed
> memory.
>
> When destroying the graph, it causes a use-after-free error detected by
> libasan:
>
> ERROR: AddressSanitizer: heap-use-after-free
> READ of size 8 at 0x7c4baa5e4da8 thread T0
>     #0 0x0000005ad224 in graph_node_fini lib/graph/graph.c:256
>     #1 0x0000005ae657 in rte_graph_destroy lib/graph/graph.c:504
>     ...
>
> freed by thread T0 here:
>     #0 0x7f1bac4e5e4b in realloc.part.0 (/lib64/libasan.so.8+0xe5e4b)
>     #1 0x0000005ab6d7 in edge_update lib/graph/node.c:271
>     #2 0x0000005abb1b in rte_node_edge_update lib/graph/node.c:339
>     ...
>
> previously allocated by thread T0 here:
>     #0 0x7f1bac4e5e4b in realloc.part.0 (/lib64/libasan.so.8+0xe5e4b)
>     #1 0x0000005ab6d7 in edge_update lib/graph/node.c:271
>     #2 0x0000005abb1b in rte_node_edge_update lib/graph/node.c:339
>     ...
>
> Use malloc+memcpy and add an internal function to replace all references
> to the old node memory before freeing it.
>
> Cc: stable at dpdk.org
> Fixes: c59dac2ca14a ("graph: implement node operations")

Acked-by: Jerin Jacob <jerinj at marvell.com>


>
> Signed-off-by: Robin Jarry <rjarry at redhat.com>
> ---
>  lib/graph/graph.c         | 14 ++++++++++++++
>  lib/graph/graph_private.h | 12 ++++++++++++
>  lib/graph/node.c          |  6 +++++-
>  3 files changed, 31 insertions(+), 1 deletion(-)
>
> diff --git a/lib/graph/graph.c b/lib/graph/graph.c
> index 61159edc7261..6911ea8abeed 100644
> --- a/lib/graph/graph.c
> +++ b/lib/graph/graph.c
> @@ -277,6 +277,20 @@ graph_node_fini(struct graph *graph)
>                                                        graph_node->node->name));
>  }
>
> +void
> +graph_node_replace_all(struct node *old, struct node *new)
> +{
> +       struct graph_node *graph_node;
> +       struct graph *graph;
> +
> +       STAILQ_FOREACH(graph, &graph_list, next) {
> +               STAILQ_FOREACH(graph_node, &graph->node_list, next) {
> +                       if (graph_node->node == old)
> +                               graph_node->node = new;
> +               }
> +       }
> +}
> +
>  static struct rte_graph *
>  graph_mem_fixup_node_ctx(struct rte_graph *graph)
>  {
> diff --git a/lib/graph/graph_private.h b/lib/graph/graph_private.h
> index 21912c0ae63f..26cdc6637192 100644
> --- a/lib/graph/graph_private.h
> +++ b/lib/graph/graph_private.h
> @@ -299,6 +299,18 @@ int graph_node_has_edge_to_src_node(struct graph *graph);
>   */
>  int graph_node_has_loop_edge(struct graph *graph);
>
> +/**
> + * @internal
> + *
> + * Replace all pointers of a given node with another one in all active graphs.
> + *
> + * @param old
> + *   Node pointer to replace in all graphs.
> + * @param new
> + *   Updated pointer.
> + */
> +void graph_node_replace_all(struct node *old, struct node *new);
> +
>  /**
>   * @internal
>   *
> diff --git a/lib/graph/node.c b/lib/graph/node.c
> index cae1c809edc4..e3359fe490a5 100644
> --- a/lib/graph/node.c
> +++ b/lib/graph/node.c
> @@ -325,11 +325,15 @@ edge_update(struct node *node, struct node *prev, rte_edge_t from,
>         need_realloc = max_edges > node->nb_edges;
>         if (need_realloc) {
>                 sz = sizeof(struct node) + (max_edges * RTE_NODE_NAMESIZE);
> -               new_node = realloc(node, sz);
> +               new_node = malloc(sz);
>                 if (new_node == NULL) {
>                         rte_errno = ENOMEM;
>                         goto restore;
>                 } else {
> +                       sz = sizeof(*node) + (node->nb_edges * RTE_NODE_NAMESIZE);
> +                       memcpy(new_node, node, sz);
> +                       graph_node_replace_all(node, new_node);
> +                       free(node);
>                         node = new_node;
>                 }
>         }
> --
> 2.51.1
>