<!DOCTYPE html><html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<p><br>
</p>
<div class="moz-cite-prefix">On 30-06-2026 20:13, Maxime Leroy
wrote:<br>
</div>
<blockquote type="cite" cite="mid:20260630144329.457643-2-maxime@leroys.fr">
<pre wrap="" class="moz-quote-pre">rte_dpaa2_close_dpcon_device() called dpcon_close() but not
dpcon_disable(). close only releases the MC control session; it does not
disable the channel. Cosmetic: an idle DPCON generates nothing and every
consumer reprograms on setup, so disable before close only to return the
channel clean, as the symmetric counterpart of the dpcon_enable() done on
setup.
Signed-off-by: Maxime Leroy <a class="moz-txt-link-rfc2396E" href="mailto:maxime@leroys.fr"><maxime@leroys.fr></a>
---
drivers/event/dpaa2/dpaa2_hw_dpcon.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/event/dpaa2/dpaa2_hw_dpcon.c b/drivers/event/dpaa2/dpaa2_hw_dpcon.c
index ea5b0d4b85..f65a63a786 100644
--- a/drivers/event/dpaa2/dpaa2_hw_dpcon.c
+++ b/drivers/event/dpaa2/dpaa2_hw_dpcon.c
@@ -128,6 +128,7 @@ rte_dpaa2_close_dpcon_device(int object_id)
if (dpcon_dev) {
rte_dpaa2_free_dpcon_dev(dpcon_dev);
+ dpcon_disable(&dpcon_dev->dpcon, CMD_PRI_LOW, dpcon_dev->token);
dpcon_close(&dpcon_dev->dpcon, CMD_PRI_LOW, dpcon_dev->token);
TAILQ_REMOVE(&dpcon_dev_list, dpcon_dev, next);
rte_free(dpcon_dev);</pre>
</blockquote>
<p>The ordering here is wrong. <code style="background-color: var(--mui-palette-action-selected); color: var(--mui-palette-success-dark); padding: 2px 4px; border-radius: 3px; font-family: Monaco, Menlo, "Ubuntu Mono", Consolas, monospace;">rte_dpaa2_free_dpcon_dev(dpcon_dev)</code>
is called
<strong>before</strong> <code style="background-color: var(--mui-palette-action-selected); color: var(--mui-palette-success-dark); padding: 2px 4px; border-radius: 3px; font-family: Monaco, Menlo, "Ubuntu Mono", Consolas, monospace;">dpcon_disable()</code>.
Once the device is returned to the shared pool
via <code style="background-color: var(--mui-palette-action-selected); color: var(--mui-palette-success-dark); padding: 2px 4px; border-radius: 3px; font-family: Monaco, Menlo, "Ubuntu Mono", Consolas, monospace;">rte_dpaa2_free_dpcon_dev()</code>,
another thread can immediately re-allocate
the same <code style="background-color: var(--mui-palette-action-selected); color: var(--mui-palette-success-dark); padding: 2px 4px; border-radius: 3px; font-family: Monaco, Menlo, "Ubuntu Mono", Consolas, monospace;">dpcon_dev</code>
pointer. The subsequent <code style="background-color: var(--mui-palette-action-selected); color: var(--mui-palette-success-dark); padding: 2px 4px; border-radius: 3px; font-family: Monaco, Menlo, "Ubuntu Mono", Consolas, monospace;">dpcon_disable()</code>
call would
then quiesce a channel already in active use by the new owner — a
use-after-free on the pool object.</p>
<p>The correct teardown sequence must be:</p>
<ol>
<li>dpcon_disable() — quiesce the hardware channel</li>
<li>dpcon_close() — release the MC control session</li>
<li>rte_dpaa2_free_dpcon_dev() — return to pool</li>
</ol>
<p>Please reorder accordingly:</p>
<p>dpcon_disable(&dpcon_dev->dpcon, CMD_PRI_LOW,
dpcon_dev->token); </p>
<p>dpcon_close(&dpcon_dev->dpcon, CMD_PRI_LOW,
dpcon_dev->token);</p>
<p> TAILQ_REMOVE(&dpcon_dev_list, dpcon_dev, next);</p>
<p> rte_dpaa2_free_dpcon_dev(dpcon_dev);</p>
<p> rte_free(dpcon_dev);</p>
<p><br>
</p>
<p><br>
</p>
<blockquote type="cite" cite="mid:20260630144329.457643-2-maxime@leroys.fr">
<pre wrap="" class="moz-quote-pre">
</pre>
</blockquote>
</body>
</html>