From: dapengx.yu@intel.com
To: Haiyue Wang <haiyue.wang@intel.com>
Cc: dev@dpdk.org, Dapeng Yu <dapengx.yu@intel.com>, stable@dpdk.org
Subject: [dpdk-dev] [PATCH] net/ixgbe: fix using heap pointer after free
Date: Fri, 9 Jul 2021 10:30:22 +0800 [thread overview]
Message-ID: <20210709023022.847686-1-dapengx.yu@intel.com> (raw)
From: Dapeng Yu <dapengx.yu@intel.com>
The original code use a heap pointer after it is freed.
This patch fix it.
Fixes: a14de8b498d1 ("net/ixgbe: destroy consistent filter")
Cc: stable@dpdk.org
Signed-off-by: Dapeng Yu <dapengx.yu@intel.com>
---
drivers/net/ixgbe/ixgbe_flow.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ixgbe/ixgbe_flow.c b/drivers/net/ixgbe/ixgbe_flow.c
index 0b10e91a9b..4db5ef4b2b 100644
--- a/drivers/net/ixgbe/ixgbe_flow.c
+++ b/drivers/net/ixgbe/ixgbe_flow.c
@@ -32,6 +32,7 @@
#include <rte_hash_crc.h>
#include <rte_flow.h>
#include <rte_flow_driver.h>
+#include <rte_tailq.h>
#include "ixgbe_logs.h"
#include "base/ixgbe_api.h"
@@ -3339,6 +3340,7 @@ ixgbe_flow_destroy(struct rte_eth_dev *dev,
struct ixgbe_hw_fdir_info *fdir_info =
IXGBE_DEV_PRIVATE_TO_FDIR_INFO(dev->data->dev_private);
struct ixgbe_rss_conf_ele *rss_filter_ptr;
+ void *tmp;
switch (filter_type) {
case RTE_ETH_FILTER_NTUPLE:
@@ -3432,7 +3434,7 @@ ixgbe_flow_destroy(struct rte_eth_dev *dev,
return ret;
}
- TAILQ_FOREACH(ixgbe_flow_mem_ptr, &ixgbe_flow_list, entries) {
+ TAILQ_FOREACH_SAFE(ixgbe_flow_mem_ptr, &ixgbe_flow_list, entries, tmp) {
if (ixgbe_flow_mem_ptr->flow == pmd_flow) {
TAILQ_REMOVE(&ixgbe_flow_list,
ixgbe_flow_mem_ptr, entries);
--
2.27.0
next reply other threads:[~2021-07-09 2:31 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-07-09 2:30 dapengx.yu [this message]
2021-07-09 2:49 ` [dpdk-dev] [PATCH] net/ixgbe: fix using heap pointer after free Wang, Haiyue
2021-07-09 3:14 ` [dpdk-dev] [PATCH v2] " dapengx.yu
2021-07-09 4:35 ` Wang, Haiyue
2021-07-09 7:29 ` Zhang, Qi Z
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210709023022.847686-1-dapengx.yu@intel.com \
--to=dapengx.yu@intel.com \
--cc=dev@dpdk.org \
--cc=haiyue.wang@intel.com \
--cc=stable@dpdk.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.