From: Bruce Richardson <bruce.richardson@intel.com>
To: Jasvinder Singh <jasvinder.singh@intel.com>
Cc: dev@dpdk.org, cristian.dumitrescu@intel.com
Subject: Re: [dpdk-dev] [PATCH] net/softnic: fix memory illegal access
Date: Fri, 20 Jul 2018 11:29:35 +0100 [thread overview]
Message-ID: <20180720102935.GA8660@bricha3-MOBL.ger.corp.intel.com> (raw)
In-Reply-To: <20180720094439.100562-1-jasvinder.singh@intel.com>
On Fri, Jul 20, 2018 at 10:44:39AM +0100, Jasvinder Singh wrote:
> While deleting the elements from the linked list, TAILQ_FOREACH causes
> read from the freed pointer. Fixes the issue by using for loop instead
> of TAILQ_FOREACH.
>
> Coverity issue: 302867
> Fixes: bef50bcb1c47 ("net/softnic: implement start and stop")
>
> Signed-off-by: Jasvinder Singh <jasvinder.singh@intel.com>
> Acked-by: Cristian Dumitrescu <cristian.dumitrescu@intel.com>
> ---
> drivers/net/softnic/rte_eth_softnic_swq.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/softnic/rte_eth_softnic_swq.c b/drivers/net/softnic/rte_eth_softnic_swq.c
> index 1944fbb..a1f1899 100644
> --- a/drivers/net/softnic/rte_eth_softnic_swq.c
> +++ b/drivers/net/softnic/rte_eth_softnic_swq.c
> @@ -36,9 +36,11 @@ softnic_swq_free(struct pmd_internals *p)
> void
> softnic_softnic_swq_free_keep_rxq_txq(struct pmd_internals *p)
> {
> - struct softnic_swq *swq;
> + struct softnic_swq *swq, *swq_next;
> +
> + for (swq = TAILQ_FIRST(&p->swq_list); swq != NULL; swq = swq_next) {
> + swq_next = TAILQ_NEXT(swq, node);
>
> - TAILQ_FOREACH(swq, &p->swq_list, node) {
> if ((strncmp(swq->name, "RXQ", strlen("RXQ")) == 0) ||
> (strncmp(swq->name, "TXQ", strlen("TXQ")) == 0))
TAILQ_FOREACH_SAFE is probably what you want to use here.
>From man page:
The macros TAILQ_FOREACH, TAILQ_FOREACH_REVERSE, TAILQ_FOREACH_SAFE, and
TAILQ_FOREACH_REVERSE_SAFE traverse the tail queue referenced by head in
the forward or reverse direction direction, assigning each element in
turn to var.
The SAFE versions use tmp to hold the next element, so var may be freed
or removed from the list.
next prev parent reply other threads:[~2018-07-20 10:29 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-07-20 9:44 Jasvinder Singh
2018-07-20 10:29 ` Bruce Richardson [this message]
2018-07-20 10:31 ` Van Haaren, Harry
2018-07-20 10:49 ` Singh, Jasvinder
2018-07-20 11:05 ` [dpdk-dev] [PATCH v2] " Jasvinder Singh
2018-07-20 15:19 ` Ferruh Yigit
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180720102935.GA8660@bricha3-MOBL.ger.corp.intel.com \
--to=bruce.richardson@intel.com \
--cc=cristian.dumitrescu@intel.com \
--cc=dev@dpdk.org \
--cc=jasvinder.singh@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).