From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from out3-smtp.messagingengine.com (out3-smtp.messagingengine.com [66.111.4.27]) by dpdk.org (Postfix) with ESMTP id 86F3F2BA3 for ; Sun, 22 Apr 2018 17:12:06 +0200 (CEST) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.nyi.internal (Postfix) with ESMTP id 36AC920E8C; Sun, 22 Apr 2018 11:12:06 -0400 (EDT) Received: from mailfrontend2 ([10.202.2.163]) by compute1.internal (MEProxy); Sun, 22 Apr 2018 11:12:06 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fridaylinux.org; h=cc:date:from:in-reply-to:message-id:references:subject:to :x-me-sender:x-me-sender:x-sasl-enc; s=fm2; bh=FB7fUmLchiM+QWNVv 07KaLT9GK5ncGkV/+SK/2wTLgE=; b=CSlgov+bL07+W4NEQMTew52P6xH8g4AE5 vdZzxqosERiDQlDG/zzmt0dhv46UfPgSP+YwmStLT00Jb+/hPS4eCSw1sG2zYxjD 9yMqKWB2YZkMBMTsMA4slvX4uwafZwqDi90donKkuFyZmb1F8YKyfHz4Y996t9XQ FgyUdaWZ6J6i2+CKWisqgwdk0I6Mw08pBvdjg1WcF/g2Qog41CAUsshLrtFXVPqy Sx7IUaXsIDNgEX4IQnkPbcxc6sRMRbZbkTp+6YnxS4membfUFieQWPJ5OG3rs0kq jWjRGGirzt4600VwLg7KBb/HQs3ai+pg/epdn/cnWuUTbrNlhLiYA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:date:from:in-reply-to:message-id :references:subject:to:x-me-sender:x-me-sender:x-sasl-enc; s= fm2; bh=FB7fUmLchiM+QWNVv07KaLT9GK5ncGkV/+SK/2wTLgE=; b=Euin4G7T 4QRCMb33I9uP1OzEEF/+0CtiuKT9fJkWK85D3ywlXB6zu848DL7Rt1VGXJY2Wr6N 67HFvSslEh/zcMe6AVlqCI80/sfL6wkvRLFXkW1uVESRvORusak9llg4ODxXwKsN 3trq45lxzf0AQjryInG5okQPT78CCJG105j+ZlPxllCV9+3yCj2qvzkKLwnJ4OqT tfUJJPmhcYXy1QLUFSwKy28KhbY4z4uzUebXhpDS2l1y0ZzWu3flPwGwaBIaBzBs V0GtxC6KFeVorp3t25D0EwhQUJCVVXq2wZ1JXQLj5RegYMrhzCpZdxqesUIcGEfu ezuWZgnEYlY5kA== X-ME-Sender: Received: from yuanhanliu-NB0.tencent.com (unknown [223.74.148.66]) by mail.messagingengine.com (Postfix) with ESMTPA id 6B1701025D; Sun, 22 Apr 2018 11:12:04 -0400 (EDT) From: Yuanhan Liu To: Allain Legacy Cc: Konstantin Ananyev , dpdk stable Date: Sun, 22 Apr 2018 23:09:36 +0800 Message-Id: <20180422150949.17523-46-yliu@fridaylinux.org> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20180422150949.17523-1-yliu@fridaylinux.org> References: <20180422150949.17523-1-yliu@fridaylinux.org> Subject: [dpdk-stable] patch 'ip_frag: fix double free of chained mbufs' has been queued to LTS release 17.11.2 X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: patches for DPDK stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 22 Apr 2018 15:12:06 -0000 Hi, FYI, your patch has been queued to LTS release 17.11.2 Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet. It will be pushed if I get no objections before 04/29/18. So please shout if anyone has objections. Thanks. --yliu --- >>From 9e228df9965720c90194ee3dc75110b1119eb127 Mon Sep 17 00:00:00 2001 From: Allain Legacy Date: Mon, 19 Mar 2018 09:25:23 -0500 Subject: [PATCH] ip_frag: fix double free of chained mbufs [ upstream commit 4f512a1919998933a39886ab2ec7f2fdde48756c ] The first mbuf and the last mbuf to be visited in the preceding loop are not set to NULL in the fragmentation table. This creates the possibility of a double free when the fragmentation table is later freed with rte_ip_frag_table_destroy(). Fixes: 95908f52393d ("ip_frag: free mbufs on reassembly table destroy") Signed-off-by: Allain Legacy Acked-by: Konstantin Ananyev --- lib/librte_ip_frag/rte_ipv4_reassembly.c | 2 ++ lib/librte_ip_frag/rte_ipv6_reassembly.c | 2 ++ 2 files changed, 4 insertions(+) diff --git a/lib/librte_ip_frag/rte_ipv4_reassembly.c b/lib/librte_ip_frag/rte_ipv4_reassembly.c index 040bd70a2..3b84dcadb 100644 --- a/lib/librte_ip_frag/rte_ipv4_reassembly.c +++ b/lib/librte_ip_frag/rte_ipv4_reassembly.c @@ -88,7 +88,9 @@ ipv4_frag_reassemble(struct ip_frag_pkt *fp) /* chain with the first fragment. */ rte_pktmbuf_adj(m, (uint16_t)(m->l2_len + m->l3_len)); rte_pktmbuf_chain(fp->frags[IP_FIRST_FRAG_IDX].mb, m); + fp->frags[curr_idx].mb = NULL; m = fp->frags[IP_FIRST_FRAG_IDX].mb; + fp->frags[IP_FIRST_FRAG_IDX].mb = NULL; /* update mbuf fields for reassembled packet. */ m->ol_flags |= PKT_TX_IP_CKSUM; diff --git a/lib/librte_ip_frag/rte_ipv6_reassembly.c b/lib/librte_ip_frag/rte_ipv6_reassembly.c index dde58cb78..26b9a8831 100644 --- a/lib/librte_ip_frag/rte_ipv6_reassembly.c +++ b/lib/librte_ip_frag/rte_ipv6_reassembly.c @@ -111,7 +111,9 @@ ipv6_frag_reassemble(struct ip_frag_pkt *fp) /* chain with the first fragment. */ rte_pktmbuf_adj(m, (uint16_t)(m->l2_len + m->l3_len)); rte_pktmbuf_chain(fp->frags[IP_FIRST_FRAG_IDX].mb, m); + fp->frags[curr_idx].mb = NULL; m = fp->frags[IP_FIRST_FRAG_IDX].mb; + fp->frags[IP_FIRST_FRAG_IDX].mb = NULL; /* update mbuf fields for reassembled packet. */ m->ol_flags |= PKT_TX_IP_CKSUM; -- 2.11.0