From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mga02.intel.com (mga02.intel.com [134.134.136.20]) by dpdk.org (Postfix) with ESMTP id 190A3160 for ; Fri, 20 Jul 2018 12:29:39 +0200 (CEST) X-Amp-Result: UNSCANNABLE X-Amp-File-Uploaded: False Received: from orsmga008.jf.intel.com ([10.7.209.65]) by orsmga101.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 20 Jul 2018 03:29:38 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.51,378,1526367600"; d="scan'208";a="58412223" Received: from bricha3-mobl.ger.corp.intel.com ([10.237.221.107]) by orsmga008.jf.intel.com with SMTP; 20 Jul 2018 03:29:36 -0700 Received: by (sSMTP sendmail emulation); Fri, 20 Jul 2018 11:29:36 +0100 Date: Fri, 20 Jul 2018 11:29:35 +0100 From: Bruce Richardson To: Jasvinder Singh Cc: dev@dpdk.org, cristian.dumitrescu@intel.com Message-ID: <20180720102935.GA8660@bricha3-MOBL.ger.corp.intel.com> References: <20180720094439.100562-1-jasvinder.singh@intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20180720094439.100562-1-jasvinder.singh@intel.com> Organization: Intel Research and Development Ireland Ltd. User-Agent: Mutt/1.10.0 (2018-05-17) Subject: Re: [dpdk-dev] [PATCH] net/softnic: fix memory illegal access X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 20 Jul 2018 10:29:40 -0000 On Fri, Jul 20, 2018 at 10:44:39AM +0100, Jasvinder Singh wrote: > While deleting the elements from the linked list, TAILQ_FOREACH causes > read from the freed pointer. Fixes the issue by using for loop instead > of TAILQ_FOREACH. > > Coverity issue: 302867 > Fixes: bef50bcb1c47 ("net/softnic: implement start and stop") > > Signed-off-by: Jasvinder Singh > Acked-by: Cristian Dumitrescu > --- > drivers/net/softnic/rte_eth_softnic_swq.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > diff --git a/drivers/net/softnic/rte_eth_softnic_swq.c b/drivers/net/softnic/rte_eth_softnic_swq.c > index 1944fbb..a1f1899 100644 > --- a/drivers/net/softnic/rte_eth_softnic_swq.c > +++ b/drivers/net/softnic/rte_eth_softnic_swq.c > @@ -36,9 +36,11 @@ softnic_swq_free(struct pmd_internals *p) > void > softnic_softnic_swq_free_keep_rxq_txq(struct pmd_internals *p) > { > - struct softnic_swq *swq; > + struct softnic_swq *swq, *swq_next; > + > + for (swq = TAILQ_FIRST(&p->swq_list); swq != NULL; swq = swq_next) { > + swq_next = TAILQ_NEXT(swq, node); > > - TAILQ_FOREACH(swq, &p->swq_list, node) { > if ((strncmp(swq->name, "RXQ", strlen("RXQ")) == 0) || > (strncmp(swq->name, "TXQ", strlen("TXQ")) == 0)) TAILQ_FOREACH_SAFE is probably what you want to use here. >>From man page: The macros TAILQ_FOREACH, TAILQ_FOREACH_REVERSE, TAILQ_FOREACH_SAFE, and TAILQ_FOREACH_REVERSE_SAFE traverse the tail queue referenced by head in the forward or reverse direction direction, assigning each element in turn to var. The SAFE versions use tmp to hold the next element, so var may be freed or removed from the list.