* [PATCH] net/nfb: fix use after free
@ 2024-10-10 17:15 Thomas Monjalon
2024-10-10 17:17 ` David Marchand
0 siblings, 1 reply; 4+ messages in thread
From: Thomas Monjalon @ 2024-10-10 17:15 UTC (permalink / raw)
To: dev
Cc: Martin Spinler, Anatoly Burakov, Morten Brørup,
Stephen Hemminger, Chengwen Feng, Wathsala Vithanage
With the annotations added to the allocation functions,
more issues are detected at compilation time:
nfb_rx.c:133:28: error: pointer 'rxq' used after 'rte_free'
It is fixed by moving the assignment before freeing the parent pointer.
Fixes: 80da7efbb4c4 ("eal: annotate allocation functions")
Signed-off-by: Thomas Monjalon <thomas@monjalon.net>
---
drivers/net/nfb/nfb_rx.c | 2 +-
drivers/net/nfb/nfb_tx.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/nfb/nfb_rx.c b/drivers/net/nfb/nfb_rx.c
index f72afafe8f..462bc3b50d 100644
--- a/drivers/net/nfb/nfb_rx.c
+++ b/drivers/net/nfb/nfb_rx.c
@@ -129,7 +129,7 @@ nfb_eth_rx_queue_release(struct rte_eth_dev *dev, uint16_t qid)
if (rxq->queue != NULL) {
ndp_close_rx_queue(rxq->queue);
- rte_free(rxq);
rxq->queue = NULL;
+ rte_free(rxq);
}
}
diff --git a/drivers/net/nfb/nfb_tx.c b/drivers/net/nfb/nfb_tx.c
index a1318a4205..cf99268c43 100644
--- a/drivers/net/nfb/nfb_tx.c
+++ b/drivers/net/nfb/nfb_tx.c
@@ -108,7 +108,7 @@ nfb_eth_tx_queue_release(struct rte_eth_dev *dev, uint16_t qid)
if (txq->queue != NULL) {
ndp_close_tx_queue(txq->queue);
- rte_free(txq);
txq->queue = NULL;
+ rte_free(txq);
}
}
--
2.46.0
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] net/nfb: fix use after free
2024-10-10 17:15 [PATCH] net/nfb: fix use after free Thomas Monjalon
@ 2024-10-10 17:17 ` David Marchand
2024-10-10 17:25 ` Thomas Monjalon
2024-10-11 11:50 ` Martin Spinler
0 siblings, 2 replies; 4+ messages in thread
From: David Marchand @ 2024-10-10 17:17 UTC (permalink / raw)
To: Thomas Monjalon
Cc: dev, Martin Spinler, Anatoly Burakov, Morten Brørup,
Stephen Hemminger, Chengwen Feng, Wathsala Vithanage
On Thu, Oct 10, 2024 at 7:16 PM Thomas Monjalon <thomas@monjalon.net> wrote:
>
> With the annotations added to the allocation functions,
> more issues are detected at compilation time:
>
> nfb_rx.c:133:28: error: pointer 'rxq' used after 'rte_free'
>
> It is fixed by moving the assignment before freeing the parent pointer.
>
> Fixes: 80da7efbb4c4 ("eal: annotate allocation functions")
>
> Signed-off-by: Thomas Monjalon <thomas@monjalon.net>
Reviewed-by: David Marchand <david.marchand@redhat.com>
--
David Marchand
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] net/nfb: fix use after free
2024-10-10 17:17 ` David Marchand
@ 2024-10-10 17:25 ` Thomas Monjalon
2024-10-11 11:50 ` Martin Spinler
1 sibling, 0 replies; 4+ messages in thread
From: Thomas Monjalon @ 2024-10-10 17:25 UTC (permalink / raw)
To: David Marchand
Cc: dev, Martin Spinler, Anatoly Burakov, Morten Brørup,
Stephen Hemminger, Chengwen Feng, Wathsala Vithanage
10/10/2024 19:17, David Marchand:
> On Thu, Oct 10, 2024 at 7:16 PM Thomas Monjalon <thomas@monjalon.net> wrote:
> >
> > With the annotations added to the allocation functions,
> > more issues are detected at compilation time:
> >
> > nfb_rx.c:133:28: error: pointer 'rxq' used after 'rte_free'
> >
> > It is fixed by moving the assignment before freeing the parent pointer.
> >
> > Fixes: 80da7efbb4c4 ("eal: annotate allocation functions")
The real cause is:
Fixes: 6435f9a0ac22 ("net/nfb: add new netcope driver")
> > Signed-off-by: Thomas Monjalon <thomas@monjalon.net>
> Reviewed-by: David Marchand <david.marchand@redhat.com>
Applied to fix compilation on the main branch.
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] net/nfb: fix use after free
2024-10-10 17:17 ` David Marchand
2024-10-10 17:25 ` Thomas Monjalon
@ 2024-10-11 11:50 ` Martin Spinler
1 sibling, 0 replies; 4+ messages in thread
From: Martin Spinler @ 2024-10-11 11:50 UTC (permalink / raw)
To: David Marchand, Thomas Monjalon
Cc: dev, Anatoly Burakov, Morten Brørup, Stephen Hemminger,
Chengwen Feng, Wathsala Vithanage
On Thu, 2024-10-10 at 19:17 +0200, David Marchand wrote:
> On Thu, Oct 10, 2024 at 7:16 PM Thomas Monjalon <thomas@monjalon.net> wrote:
> >
> > With the annotations added to the allocation functions,
> > more issues are detected at compilation time:
> >
> > nfb_rx.c:133:28: error: pointer 'rxq' used after 'rte_free'
> >
> > It is fixed by moving the assignment before freeing the parent pointer.
> >
> > Fixes: 80da7efbb4c4 ("eal: annotate allocation functions")
> >
> > Signed-off-by: Thomas Monjalon <thomas@monjalon.net>
> Reviewed-by: David Marchand <david.marchand@redhat.com>
>
>
Acked-by: Martin Spinler <spinler@cesnet.cz>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2024-10-11 11:50 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-10-10 17:15 [PATCH] net/nfb: fix use after free Thomas Monjalon
2024-10-10 17:17 ` David Marchand
2024-10-10 17:25 ` Thomas Monjalon
2024-10-11 11:50 ` Martin Spinler
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).