<div data-ntes="ntes_mail_body_root" style="line-height:1.7;color:#000000;font-size:14px;font-family:Arial"><div id="spnEditorContent"><p style="margin: 0;">Hello Maxime Coquelin£¬</p><p style="margin: 0;"><br></p><div id="spnEditorContent" style="word-break: break-word !important;"><p style="margin: 0px; word-break: break-word !important;">The scenario where I encountered coredump was ovs-dpdk£¬</p><p style="margin: 0px; word-break: break-word !important;">similar to patch: <a _src="https://github.com/DPDK/dpdk/commit/52d874dc67055a943867456d3e5c730168bfba18" href="https://github.com/DPDK/dpdk/commit/52d874dc67055a943867456d3e5c730168bfba18" style="color: rgb(51, 112, 255); word-break: break-word !important;">https://github.com/DPDK/dpdk/commit/52d874dc67055a943867456d3e5c730168bfba18</a>.</p><p style="margin: 0px; word-break: break-word !important;">Only one thread called rte_vhost_driver_unregister(), but at the same time, </p><p style="margin: 0px; word-break: break-word !important;">two other threads called vhost_user_read_cb() and vhost_user_client_reconnect() respectively.</p><p style="margin: 0px; word-break: break-word !important;"><br style="word-break: break-word !important;"></p><p style="margin: 0px; word-break: break-word !important;">The specific reasons for coredump are as follows£º</p><p style="margin: 0px; word-break: break-word !important;">vhostuser port is created as client.</p><p style="margin: 0px; word-break: break-word !important;">Thread 1 calls rte_vhost_driver_unregister() to remove the vsocket of reconn from the reconn list.</p></div><div style="position: relative; zoom: 1; word-break: break-word !important;"></div><div id="divNeteaseMailCard" style="word-break: break-word !important;"></div><div style="margin: 0px; word-break: break-word !important;">then ¡°vhost-events¡± thread calls vhost_user_read_cb() to add the vsocket of reconn back to the reconn list.</div><div style="margin: 0px; word-break: break-word !important;">At this time, after thread 1 releases the vsocket memory, the socket of vhostuser reconnects successfully, </div><div style="margin: 0px; word-break: break-word !important;">"vhost_reconn" thread will access the released memory.</div><pre style="width: 2210.64px; word-break: break-word !important;"><div style="white-space: unset !important; word-break: break-word !important;">Therefore, The fix is to perform a delete operation again after releasing the memory.</div><div style="white-space: unset !important; word-break: break-word !important;"><br></div></pre><p style="margin: 0;">I have resubmitted the patch, please review it again.</p><p style="margin: 0;"><a href="https://patches.dpdk.org/project/dpdk/patch/20240625093149.63247-1-15957197901@163.com/" _src="https://patches.dpdk.org/project/dpdk/patch/20240625093149.63247-1-15957197901@163.com/">https://patches.dpdk.org/project/dpdk/patch/20240625093149.63247-1-15957197901@163.com/</a> </p><p style="margin: 0;"><br></p><p style="margin: 0;"><br></p></div><pre>At 2024-06-24 17:20:00, "Maxime Coquelin" <maxime.coquelin@redhat.com> wrote:
>Hi,
>
>On 6/19/24 14:27, zhaoxinxin wrote:
>> The rte_vhost_driver_unregister() vhost_user_read_cb()
>> vhost_user_client_reconnect() can be called at the same time by 3 threads.
>> when memory of vsocket is freed in rte_vhost_driver_unregister(),
>> then vhost_user_read_cb() maybe add vsocket to reconn_list,
>> the invalid memory of vsocket is accessed in vhost_user_client_reconnect().
>
>It is not clear to me why 3 threads are calling
>rte_vhost_driver_unregister() at the same time, isn't it an application
>issue?
>
>> The core trace is:
>> Program terminated with signal 11, Segmentation fault.
>> The fix is to perform a delete operation again after releasing the memory
>>
>
>We need a Fixes tag and Cc stable@dpdk.org so that it is backported.
>
>> Signed-off-by: zhaoxinxin <15957197901@163.com>
>
>The format is Firstname Lastname <email>
>
>
>> ---
>> lib/vhost/socket.c | 2 ++
>> 1 file changed, 2 insertions(+)
>>
>> diff --git a/lib/vhost/socket.c b/lib/vhost/socket.c
>> index a75728a2e4..01946096c4 100644
>> --- a/lib/vhost/socket.c
>> +++ b/lib/vhost/socket.c
>> @@ -1121,6 +1121,8 @@ rte_vhost_driver_unregister(const char *path)
>> if (vsocket->is_server) {
>> close(vsocket->socket_fd);
>> unlink(path);
>> + } else if (vsocket->reconnect) {
>> + vhost_user_remove_reconnect(vsocket);
>> }
>>
>> pthread_mutex_destroy(&vsocket->conn_mutex);
</pre></div>