* [RFC 02/47] net/nfp: fix use after free [not found] <20250818233102.180207-1-stephen@networkplumber.org> @ 2025-08-18 23:27 ` Stephen Hemminger 2025-08-18 23:27 ` [RFC 23/47] net/bnxt: remove use of sys/queue.h Stephen Hemminger [not found] ` <20250825034126.12046-1-stephen@networkplumber.org> 2 siblings, 0 replies; 4+ messages in thread From: Stephen Hemminger @ 2025-08-18 23:27 UTC (permalink / raw) To: dev Cc: Stephen Hemminger, jin.liu, stable, Chaoyong He, Niklas Söderlund, Peng Zhang The code to cleanup metering was using the objects after calling rte_free(). Can fix now by using LIST_FOREACH_SAFE(). Fixes: 2caf84a71cfd ("net/nfp: add meter options") Cc: jin.liu@corigine.com Cc: stable@dpdk.org Signed-off-by: Stephen Hemminger <stephen@networkplumber.org> --- drivers/net/nfp/nfp_mtr.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/net/nfp/nfp_mtr.c b/drivers/net/nfp/nfp_mtr.c index d4f2c4f2f0..904d2126e7 100644 --- a/drivers/net/nfp/nfp_mtr.c +++ b/drivers/net/nfp/nfp_mtr.c @@ -1124,10 +1124,10 @@ nfp_mtr_priv_init(struct nfp_pf_dev *pf_dev) void nfp_mtr_priv_uninit(struct nfp_pf_dev *pf_dev) { - struct nfp_mtr *mtr; + struct nfp_mtr *mtr, *tmp_mtr; struct nfp_mtr_priv *priv; - struct nfp_mtr_policy *mtr_policy; - struct nfp_mtr_profile *mtr_profile; + struct nfp_mtr_policy *mtr_policy, *tmp_policy; + struct nfp_mtr_profile *mtr_profile, *tmp_profile; struct nfp_app_fw_flower *app_fw_flower; app_fw_flower = NFP_PRIV_TO_APP_FW_FLOWER(pf_dev->app_fw_priv); @@ -1135,17 +1135,17 @@ nfp_mtr_priv_uninit(struct nfp_pf_dev *pf_dev) rte_eal_alarm_cancel(nfp_mtr_stats_request, (void *)app_fw_flower); - LIST_FOREACH(mtr, &priv->mtrs, next) { + LIST_FOREACH_SAFE(mtr, &priv->mtrs, next, tmp_mtr) { LIST_REMOVE(mtr, next); rte_free(mtr); } - LIST_FOREACH(mtr_profile, &priv->profiles, next) { + LIST_FOREACH_SAFE(mtr_profile, &priv->profiles, next, tmp_profile) { LIST_REMOVE(mtr_profile, next); rte_free(mtr_profile); } - LIST_FOREACH(mtr_policy, &priv->policies, next) { + LIST_FOREACH_SAFE(mtr_policy, &priv->policies, next, tmp_policy) { LIST_REMOVE(mtr_policy, next); rte_free(mtr_policy); } -- 2.47.2 ^ permalink raw reply [flat|nested] 4+ messages in thread
* [RFC 23/47] net/bnxt: remove use of sys/queue.h [not found] <20250818233102.180207-1-stephen@networkplumber.org> 2025-08-18 23:27 ` [RFC 02/47] net/nfp: fix use after free Stephen Hemminger @ 2025-08-18 23:27 ` Stephen Hemminger [not found] ` <20250825034126.12046-1-stephen@networkplumber.org> 2 siblings, 0 replies; 4+ messages in thread From: Stephen Hemminger @ 2025-08-18 23:27 UTC (permalink / raw) To: dev; +Cc: Stephen Hemminger, ajit.khaparde, stable, Somnath Kotur, Kalesh AP Fix unsafe use after free by using STAILQ_FOREACH_SAFE. Fixes: e8fe0e067b68 ("net/bnxt: fix allocation of PF info struct") Cc: ajit.khaparde@broadcom.com Cc: stable@dpdk.org Signed-off-by: Stephen Hemminger <stephen@networkplumber.org> --- drivers/net/bnxt/bnxt.h | 1 - drivers/net/bnxt/bnxt_filter.c | 7 +++---- drivers/net/bnxt/bnxt_flow.c | 1 - drivers/net/bnxt/bnxt_vnic.h | 1 - drivers/net/bnxt/tf_ulp/bnxt_ulp.h | 1 - drivers/net/bnxt/tf_ulp/bnxt_ulp_meter.c | 1 - 6 files changed, 3 insertions(+), 9 deletions(-) diff --git a/drivers/net/bnxt/bnxt.h b/drivers/net/bnxt/bnxt.h index c9fdd36d3e..e9099a3ff2 100644 --- a/drivers/net/bnxt/bnxt.h +++ b/drivers/net/bnxt/bnxt.h @@ -9,7 +9,6 @@ #include <inttypes.h> #include <stdbool.h> #include <pthread.h> -#include <sys/queue.h> #include <rte_pci.h> #include <bus_pci_driver.h> diff --git a/drivers/net/bnxt/bnxt_filter.c b/drivers/net/bnxt/bnxt_filter.c index 7b90ba651f..4c44506daa 100644 --- a/drivers/net/bnxt/bnxt_filter.c +++ b/drivers/net/bnxt/bnxt_filter.c @@ -3,8 +3,7 @@ * All rights reserved. */ -#include <sys/queue.h> - +#include <bsd_queue.h> #include <rte_byteorder.h> #include <rte_log.h> #include <rte_malloc.h> @@ -110,7 +109,7 @@ void bnxt_free_all_filters(struct bnxt *bp) void bnxt_free_filter_mem(struct bnxt *bp) { - struct bnxt_filter_info *filter; + struct bnxt_filter_info *filter, *tmp; uint16_t max_filters, i; int rc = 0; @@ -151,7 +150,7 @@ void bnxt_free_filter_mem(struct bnxt *bp) bp->filter_info = NULL; for (i = 0; i < bp->pf->max_vfs; i++) { - STAILQ_FOREACH(filter, &bp->pf->vf_info[i].filter, next) { + STAILQ_FOREACH_SAFE(filter, &bp->pf->vf_info[i].filter, next, tmp) { rte_free(filter); STAILQ_REMOVE(&bp->pf->vf_info[i].filter, filter, bnxt_filter_info, next); diff --git a/drivers/net/bnxt/bnxt_flow.c b/drivers/net/bnxt/bnxt_flow.c index a2e590540b..d3da309254 100644 --- a/drivers/net/bnxt/bnxt_flow.c +++ b/drivers/net/bnxt/bnxt_flow.c @@ -3,7 +3,6 @@ * All rights reserved. */ -#include <sys/queue.h> #include <rte_log.h> #include <rte_malloc.h> diff --git a/drivers/net/bnxt/bnxt_vnic.h b/drivers/net/bnxt/bnxt_vnic.h index 5a4fd4ecb7..be232df2e7 100644 --- a/drivers/net/bnxt/bnxt_vnic.h +++ b/drivers/net/bnxt/bnxt_vnic.h @@ -6,7 +6,6 @@ #ifndef _BNXT_VNIC_H_ #define _BNXT_VNIC_H_ -#include <sys/queue.h> #include <stdbool.h> #include <rte_hash.h> diff --git a/drivers/net/bnxt/tf_ulp/bnxt_ulp.h b/drivers/net/bnxt/tf_ulp/bnxt_ulp.h index e0e31532fd..f8c46186fe 100644 --- a/drivers/net/bnxt/tf_ulp/bnxt_ulp.h +++ b/drivers/net/bnxt/tf_ulp/bnxt_ulp.h @@ -8,7 +8,6 @@ #include <inttypes.h> #include <stdbool.h> -#include <sys/queue.h> #include "rte_version.h" #include "rte_ethdev.h" diff --git a/drivers/net/bnxt/tf_ulp/bnxt_ulp_meter.c b/drivers/net/bnxt/tf_ulp/bnxt_ulp_meter.c index 591bde96e8..cd97bc6635 100644 --- a/drivers/net/bnxt/tf_ulp/bnxt_ulp_meter.c +++ b/drivers/net/bnxt/tf_ulp/bnxt_ulp_meter.c @@ -4,7 +4,6 @@ */ #include <math.h> -#include <sys/queue.h> #include <rte_log.h> #include <rte_malloc.h> -- 2.47.2 ^ permalink raw reply [flat|nested] 4+ messages in thread
[parent not found: <20250825034126.12046-1-stephen@networkplumber.org>]
* [PATCH v2 01/43] net/nfp: fix use after free [not found] ` <20250825034126.12046-1-stephen@networkplumber.org> @ 2025-08-25 3:38 ` Stephen Hemminger 2025-08-25 3:38 ` [PATCH v2 15/43] net/bnxt: remove use of sys/queue.h Stephen Hemminger 1 sibling, 0 replies; 4+ messages in thread From: Stephen Hemminger @ 2025-08-25 3:38 UTC (permalink / raw) To: dev Cc: Stephen Hemminger, jin.liu, stable, Chaoyong He, Niklas Söderlund, Peng Zhang The code to cleanup metering was using the objects after calling rte_free(). Fix by using LISTFOREACH_SAFE Fixes: 2caf84a71cfd ("net/nfp: add meter options") Cc: jin.liu@corigine.com Cc: stable@dpdk.org Signed-off-by: Stephen Hemminger <stephen@networkplumber.org> --- drivers/net/nfp/nfp_mtr.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/drivers/net/nfp/nfp_mtr.c b/drivers/net/nfp/nfp_mtr.c index d4f2c4f2f0..4833ebd881 100644 --- a/drivers/net/nfp/nfp_mtr.c +++ b/drivers/net/nfp/nfp_mtr.c @@ -12,6 +12,13 @@ #include "flower/nfp_flower_representor.h" #include "nfp_logs.h" +#ifndef LIST_FOREACH_SAFE +#define LIST_FOREACH_SAFE(var, head, field, tvar) \ + for ((var) = LIST_FIRST((head)); \ + (var) && ((tvar) = LIST_NEXT((var), field), 1); \ + (var) = (tvar)) +#endif + #define NFP_MAX_POLICY_CNT NFP_MAX_MTR_CNT #define NFP_MAX_PROFILE_CNT NFP_MAX_MTR_CNT @@ -1124,10 +1131,10 @@ nfp_mtr_priv_init(struct nfp_pf_dev *pf_dev) void nfp_mtr_priv_uninit(struct nfp_pf_dev *pf_dev) { - struct nfp_mtr *mtr; + struct nfp_mtr *mtr, *tmp_mtr; struct nfp_mtr_priv *priv; - struct nfp_mtr_policy *mtr_policy; - struct nfp_mtr_profile *mtr_profile; + struct nfp_mtr_policy *mtr_policy, *tmp_policy; + struct nfp_mtr_profile *mtr_profile, *tmp_profile; struct nfp_app_fw_flower *app_fw_flower; app_fw_flower = NFP_PRIV_TO_APP_FW_FLOWER(pf_dev->app_fw_priv); @@ -1135,17 +1142,17 @@ nfp_mtr_priv_uninit(struct nfp_pf_dev *pf_dev) rte_eal_alarm_cancel(nfp_mtr_stats_request, (void *)app_fw_flower); - LIST_FOREACH(mtr, &priv->mtrs, next) { + LIST_FOREACH_SAFE(mtr, &priv->mtrs, next, tmp_mtr) { LIST_REMOVE(mtr, next); rte_free(mtr); } - LIST_FOREACH(mtr_profile, &priv->profiles, next) { + LIST_FOREACH_SAFE(mtr_profile, &priv->profiles, next, tmp_profile) { LIST_REMOVE(mtr_profile, next); rte_free(mtr_profile); } - LIST_FOREACH(mtr_policy, &priv->policies, next) { + LIST_FOREACH_SAFE(mtr_policy, &priv->policies, next, tmp_policy) { LIST_REMOVE(mtr_policy, next); rte_free(mtr_policy); } -- 2.47.2 ^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH v2 15/43] net/bnxt: remove use of sys/queue.h [not found] ` <20250825034126.12046-1-stephen@networkplumber.org> 2025-08-25 3:38 ` [PATCH v2 01/43] net/nfp: fix use after free Stephen Hemminger @ 2025-08-25 3:38 ` Stephen Hemminger 1 sibling, 0 replies; 4+ messages in thread From: Stephen Hemminger @ 2025-08-25 3:38 UTC (permalink / raw) To: dev; +Cc: Stephen Hemminger, ajit.khaparde, stable, Somnath Kotur, Kalesh AP Fix unsafe use after free by using STAILQ_FOREACH_SAFE. Fixes: e8fe0e067b68 ("net/bnxt: fix allocation of PF info struct") Cc: ajit.khaparde@broadcom.com Cc: stable@dpdk.org Signed-off-by: Stephen Hemminger <stephen@networkplumber.org> --- drivers/net/bnxt/bnxt.h | 1 - drivers/net/bnxt/bnxt_filter.c | 7 +++---- drivers/net/bnxt/bnxt_flow.c | 1 - drivers/net/bnxt/bnxt_vnic.h | 1 - drivers/net/bnxt/tf_ulp/bnxt_ulp.h | 1 - drivers/net/bnxt/tf_ulp/bnxt_ulp_meter.c | 1 - 6 files changed, 3 insertions(+), 9 deletions(-) diff --git a/drivers/net/bnxt/bnxt.h b/drivers/net/bnxt/bnxt.h index c9fdd36d3e..e9099a3ff2 100644 --- a/drivers/net/bnxt/bnxt.h +++ b/drivers/net/bnxt/bnxt.h @@ -9,7 +9,6 @@ #include <inttypes.h> #include <stdbool.h> #include <pthread.h> -#include <sys/queue.h> #include <rte_pci.h> #include <bus_pci_driver.h> diff --git a/drivers/net/bnxt/bnxt_filter.c b/drivers/net/bnxt/bnxt_filter.c index 7b90ba651f..0176b9f7cf 100644 --- a/drivers/net/bnxt/bnxt_filter.c +++ b/drivers/net/bnxt/bnxt_filter.c @@ -3,8 +3,7 @@ * All rights reserved. */ -#include <sys/queue.h> - +#include <rte_bsd_queue.h> #include <rte_byteorder.h> #include <rte_log.h> #include <rte_malloc.h> @@ -110,7 +109,7 @@ void bnxt_free_all_filters(struct bnxt *bp) void bnxt_free_filter_mem(struct bnxt *bp) { - struct bnxt_filter_info *filter; + struct bnxt_filter_info *filter, *tmp; uint16_t max_filters, i; int rc = 0; @@ -151,7 +150,7 @@ void bnxt_free_filter_mem(struct bnxt *bp) bp->filter_info = NULL; for (i = 0; i < bp->pf->max_vfs; i++) { - STAILQ_FOREACH(filter, &bp->pf->vf_info[i].filter, next) { + STAILQ_FOREACH_SAFE(filter, &bp->pf->vf_info[i].filter, next, tmp) { rte_free(filter); STAILQ_REMOVE(&bp->pf->vf_info[i].filter, filter, bnxt_filter_info, next); diff --git a/drivers/net/bnxt/bnxt_flow.c b/drivers/net/bnxt/bnxt_flow.c index a2e590540b..d3da309254 100644 --- a/drivers/net/bnxt/bnxt_flow.c +++ b/drivers/net/bnxt/bnxt_flow.c @@ -3,7 +3,6 @@ * All rights reserved. */ -#include <sys/queue.h> #include <rte_log.h> #include <rte_malloc.h> diff --git a/drivers/net/bnxt/bnxt_vnic.h b/drivers/net/bnxt/bnxt_vnic.h index 5a4fd4ecb7..be232df2e7 100644 --- a/drivers/net/bnxt/bnxt_vnic.h +++ b/drivers/net/bnxt/bnxt_vnic.h @@ -6,7 +6,6 @@ #ifndef _BNXT_VNIC_H_ #define _BNXT_VNIC_H_ -#include <sys/queue.h> #include <stdbool.h> #include <rte_hash.h> diff --git a/drivers/net/bnxt/tf_ulp/bnxt_ulp.h b/drivers/net/bnxt/tf_ulp/bnxt_ulp.h index e0e31532fd..f8c46186fe 100644 --- a/drivers/net/bnxt/tf_ulp/bnxt_ulp.h +++ b/drivers/net/bnxt/tf_ulp/bnxt_ulp.h @@ -8,7 +8,6 @@ #include <inttypes.h> #include <stdbool.h> -#include <sys/queue.h> #include "rte_version.h" #include "rte_ethdev.h" diff --git a/drivers/net/bnxt/tf_ulp/bnxt_ulp_meter.c b/drivers/net/bnxt/tf_ulp/bnxt_ulp_meter.c index 591bde96e8..cd97bc6635 100644 --- a/drivers/net/bnxt/tf_ulp/bnxt_ulp_meter.c +++ b/drivers/net/bnxt/tf_ulp/bnxt_ulp_meter.c @@ -4,7 +4,6 @@ */ #include <math.h> -#include <sys/queue.h> #include <rte_log.h> #include <rte_malloc.h> -- 2.47.2 ^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2025-08-25 3:42 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <20250818233102.180207-1-stephen@networkplumber.org>
2025-08-18 23:27 ` [RFC 02/47] net/nfp: fix use after free Stephen Hemminger
2025-08-18 23:27 ` [RFC 23/47] net/bnxt: remove use of sys/queue.h Stephen Hemminger
[not found] ` <20250825034126.12046-1-stephen@networkplumber.org>
2025-08-25 3:38 ` [PATCH v2 01/43] net/nfp: fix use after free Stephen Hemminger
2025-08-25 3:38 ` [PATCH v2 15/43] net/bnxt: remove use of sys/queue.h Stephen Hemminger
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).