DPDK patches and discussions
 help / color / mirror / Atom feed
From: Stephen Hemminger <stephen@networkplumber.org>
To: dev@dpdk.org
Cc: Stephen Hemminger <stephen@networkplumber.org>,
	ajit.khaparde@broadcom.com, stable@dpdk.org,
	Somnath Kotur <somnath.kotur@broadcom.com>,
	Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
Subject: [PATCH v2 2/5] net/bnxt: fix use after free
Date: Thu, 19 Dec 2024 14:49:52 -0800	[thread overview]
Message-ID: <20241219225253.782792-3-stephen@networkplumber.org> (raw)
In-Reply-To: <20241219225253.782792-1-stephen@networkplumber.org>

The filter cleanup loop was using STAILQ_FOREACH and rte_free
and would dereference the filter after free.

Found by build with -Dbsanitize=address,undefined

Fixes: e8fe0e067b68 ("net/bnxt: fix allocation of PF info struct")
Cc: ajit.khaparde@broadcom.com
Cc: stable@dpdk.org

Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
---
 drivers/net/bnxt/bnxt_filter.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/drivers/net/bnxt/bnxt_filter.c b/drivers/net/bnxt/bnxt_filter.c
index 7b90ba651f..3804a5ec16 100644
--- a/drivers/net/bnxt/bnxt_filter.c
+++ b/drivers/net/bnxt/bnxt_filter.c
@@ -12,6 +12,13 @@
 #include <rte_flow_driver.h>
 #include <rte_tailq.h>
 
+#ifndef STAILQ_FOREACH_SAFE
+#define	STAILQ_FOREACH_SAFE(var, head, field, tvar)			\
+	for ((var) = STAILQ_FIRST((head));				\
+	    (var) && ((tvar) = STAILQ_NEXT((var), field), 1);		\
+	    (var) = (tvar))
+#endif
+
 #include "bnxt.h"
 #include "bnxt_filter.h"
 #include "bnxt_hwrm.h"
@@ -151,7 +158,9 @@ void bnxt_free_filter_mem(struct bnxt *bp)
 	bp->filter_info = NULL;
 
 	for (i = 0; i < bp->pf->max_vfs; i++) {
-		STAILQ_FOREACH(filter, &bp->pf->vf_info[i].filter, next) {
+		struct bnxt_filter_info *tmp;
+
+		STAILQ_FOREACH_SAFE(filter, &bp->pf->vf_info[i].filter, next, tmp) {
 			rte_free(filter);
 			STAILQ_REMOVE(&bp->pf->vf_info[i].filter, filter,
 				      bnxt_filter_info, next);
-- 
2.45.2


  parent reply	other threads:[~2024-12-19 22:53 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-12-18 17:05 [PATCH] bus/fslmc: fix use after rte_free Stephen Hemminger
2024-12-19 22:49 ` [PATCH v2 0/5] Fixes for build with -Dsanitize=undefined Stephen Hemminger
2024-12-19 22:49   ` [PATCH v2 1/5] bus/fslmc: fix use after rte_free Stephen Hemminger
2024-12-19 22:49   ` Stephen Hemminger [this message]
2024-12-19 22:49   ` [PATCH v2 3/5] net/bnx2x: use RTE_BIT32 Stephen Hemminger
2024-12-19 22:49   ` [PATCH v2 4/5] net/qede: fix use after free Stephen Hemminger
2024-12-19 22:49   ` [PATCH v2 5/5] vhost: use strlcpy instead of strncpy Stephen Hemminger
2024-12-20 13:37     ` Bruce Richardson

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20241219225253.782792-3-stephen@networkplumber.org \
    --to=stephen@networkplumber.org \
    --cc=ajit.khaparde@broadcom.com \
    --cc=dev@dpdk.org \
    --cc=kalesh-anakkur.purayil@broadcom.com \
    --cc=somnath.kotur@broadcom.com \
    --cc=stable@dpdk.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).