From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id BA15C45B08; Thu, 10 Oct 2024 19:16:13 +0200 (CEST) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 55FF6402A3; Thu, 10 Oct 2024 19:16:13 +0200 (CEST) Received: from fout-a3-smtp.messagingengine.com (fout-a3-smtp.messagingengine.com [103.168.172.146]) by mails.dpdk.org (Postfix) with ESMTP id EC96140144 for ; Thu, 10 Oct 2024 19:16:11 +0200 (CEST) Received: from phl-compute-07.internal (phl-compute-07.phl.internal [10.202.2.47]) by mailfout.phl.internal (Postfix) with ESMTP id 5F3C21380471; Thu, 10 Oct 2024 13:16:11 -0400 (EDT) Received: from phl-mailfrontend-01 ([10.202.2.162]) by phl-compute-07.internal (MEProxy); Thu, 10 Oct 2024 13:16:11 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=monjalon.net; h= cc:cc:content-transfer-encoding:content-type:date:date:from:from :in-reply-to:message-id:mime-version:reply-to:subject:subject:to :to; s=fm2; t=1728580571; x=1728666971; bh=oGF4xWa51hvXiy3aZ4IPK JFTKjoC5oasw5GxZgn8Quc=; b=iczrFQNYbYLhmKuWjbfjuZtpCWBbbrRNlp85d fK9VzDyK3h2yIp+0wSDT6c1kX/RIiV2zKJdRWVemrfUw6zOQ8sURB+uuEuFIwYrR zZg4THQXqWD3KTtWL8FUTQq/siTEsjVa/lX/TagOrgOQJ+8HHN7U64NhQDcQr1wQ GrACsuTBECv8AObyMKWfA6SynRohGfJ3a04QRNxsuANXLU3p3pvv8VDNdcnSoKzG Bp+4zST4gXgnIEgXB8r/cH3hwy/ZD5v0/c0TKUCUGsWpuOaEW1wtwGjvHoCF38AY Zi2DZHmJsuirFjG7Xtq3OKZdYXh3sGZMGYfC3pLlt3ggKnFjQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:date:date:feedback-id:feedback-id:from:from :in-reply-to:message-id:mime-version:reply-to:subject:subject:to :to:x-me-proxy:x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s= fm2; t=1728580571; x=1728666971; bh=oGF4xWa51hvXiy3aZ4IPKJFTKjoC 5oasw5GxZgn8Quc=; b=NBxv+3V81+FCx4ayzT1C1EirbX+9Jw75CD+5LM6tul47 m6FfeDXVh08hLXScJTxfakTLRc9cNAH7tinJ+O4hDyYMzHD5tj689c05p0qrmq4K JWAmIch+NIAylZEo1o23rxpZQnjgECMbTkRUWfnD4/RvKUVQfLsg3ERLdIenvx7K UOq5uSBVKj6qy/VMlhj1aSQwHh0siIAjLkajlfrK9W6ZeGBs6fvRaoNmFZahkg92 5qYkfax6v80a8/MYz+rrdV0m+8STXVqU+aO1xRgLjtF/P6i3coVlwm1hFhq3PHEG A4Lpnk9DW2T7ZRBlCrpba072gY8DTKPEfzPdm40uEA== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeeftddrvdefhedguddufecutefuodetggdotefrod ftvfcurfhrohhfihhlvgemucfhrghsthforghilhdpggftfghnshhusghstghrihgsvgdp uffrtefokffrpgfnqfghnecuuegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivg hnthhsucdlqddutddtmdenucfjughrpefhvfevufffkffoggfgsedtkeertdertddtnecu hfhrohhmpefvhhhomhgrshcuofhonhhjrghlohhnuceothhhohhmrghssehmohhnjhgrlh honhdrnhgvtheqnecuggftrfgrthhtvghrnhepveevfeevieeihfetudekgeekleeigeff ueekveduteeuffeiudevteeiudekfeelnecuvehluhhsthgvrhfuihiivgeptdenucfrrg hrrghmpehmrghilhhfrhhomhepthhhohhmrghssehmohhnjhgrlhhonhdrnhgvthdpnhgs pghrtghpthhtohepjedpmhhouggvpehsmhhtphhouhhtpdhrtghpthhtohepuggvvhesug hpughkrdhorhhgpdhrtghpthhtohepshhpihhnlhgvrhestggvshhnvghtrdgtiidprhgt phhtthhopegrnhgrthholhihrdgsuhhrrghkohhvsehinhhtvghlrdgtohhmpdhrtghpth htohepmhgssehsmhgrrhhtshhhrghrvghshihsthgvmhhsrdgtohhmpdhrtghpthhtohep shhtvghphhgvnhesnhgvthifohhrkhhplhhumhgsvghrrdhorhhgpdhrtghpthhtohepfh gvnhhgtghhvghnghifvghnsehhuhgrfigvihdrtghomhdprhgtphhtthhopeifrghthhhs rghlrgdrvhhithhhrghnrghgvgesrghrmhdrtghomh X-ME-Proxy: Feedback-ID: i47234305:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Thu, 10 Oct 2024 13:16:08 -0400 (EDT) From: Thomas Monjalon To: dev@dpdk.org Cc: Martin Spinler , Anatoly Burakov , =?UTF-8?q?Morten=20Br=C3=B8rup?= , Stephen Hemminger , Chengwen Feng , Wathsala Vithanage Subject: [PATCH] net/nfb: fix use after free Date: Thu, 10 Oct 2024 19:15:46 +0200 Message-ID: <20241010171547.2510123-1-thomas@monjalon.net> X-Mailer: git-send-email 2.46.0 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org With the annotations added to the allocation functions, more issues are detected at compilation time: nfb_rx.c:133:28: error: pointer 'rxq' used after 'rte_free' It is fixed by moving the assignment before freeing the parent pointer. Fixes: 80da7efbb4c4 ("eal: annotate allocation functions") Signed-off-by: Thomas Monjalon --- drivers/net/nfb/nfb_rx.c | 2 +- drivers/net/nfb/nfb_tx.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/nfb/nfb_rx.c b/drivers/net/nfb/nfb_rx.c index f72afafe8f..462bc3b50d 100644 --- a/drivers/net/nfb/nfb_rx.c +++ b/drivers/net/nfb/nfb_rx.c @@ -129,7 +129,7 @@ nfb_eth_rx_queue_release(struct rte_eth_dev *dev, uint16_t qid) if (rxq->queue != NULL) { ndp_close_rx_queue(rxq->queue); - rte_free(rxq); rxq->queue = NULL; + rte_free(rxq); } } diff --git a/drivers/net/nfb/nfb_tx.c b/drivers/net/nfb/nfb_tx.c index a1318a4205..cf99268c43 100644 --- a/drivers/net/nfb/nfb_tx.c +++ b/drivers/net/nfb/nfb_tx.c @@ -108,7 +108,7 @@ nfb_eth_tx_queue_release(struct rte_eth_dev *dev, uint16_t qid) if (txq->queue != NULL) { ndp_close_tx_queue(txq->queue); - rte_free(txq); txq->queue = NULL; + rte_free(txq); } } -- 2.46.0