From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 39A18A0A0C; Fri, 9 Jul 2021 04:31:30 +0200 (CEST) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id B15584014D; Fri, 9 Jul 2021 04:31:29 +0200 (CEST) Received: from mga07.intel.com (mga07.intel.com [134.134.136.100]) by mails.dpdk.org (Postfix) with ESMTP id 980F540143; Fri, 9 Jul 2021 04:31:28 +0200 (CEST) X-IronPort-AV: E=McAfee;i="6200,9189,10039"; a="273469979" X-IronPort-AV: E=Sophos;i="5.84,225,1620716400"; d="scan'208";a="273469979" Received: from fmsmga003.fm.intel.com ([10.253.24.29]) by orsmga105.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 08 Jul 2021 19:31:27 -0700 X-IronPort-AV: E=Sophos;i="5.84,225,1620716400"; d="scan'208";a="487886674" Received: from unknown (HELO localhost.localdomain) ([10.240.183.93]) by fmsmga003-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 08 Jul 2021 19:31:25 -0700 From: dapengx.yu@intel.com To: Haiyue Wang Cc: dev@dpdk.org, Dapeng Yu , stable@dpdk.org Date: Fri, 9 Jul 2021 10:30:22 +0800 Message-Id: <20210709023022.847686-1-dapengx.yu@intel.com> X-Mailer: git-send-email 2.27.0 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Subject: [dpdk-dev] [PATCH] net/ixgbe: fix using heap pointer after free X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" From: Dapeng Yu The original code use a heap pointer after it is freed. This patch fix it. Fixes: a14de8b498d1 ("net/ixgbe: destroy consistent filter") Cc: stable@dpdk.org Signed-off-by: Dapeng Yu --- drivers/net/ixgbe/ixgbe_flow.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/ixgbe/ixgbe_flow.c b/drivers/net/ixgbe/ixgbe_flow.c index 0b10e91a9b..4db5ef4b2b 100644 --- a/drivers/net/ixgbe/ixgbe_flow.c +++ b/drivers/net/ixgbe/ixgbe_flow.c @@ -32,6 +32,7 @@ #include #include #include +#include #include "ixgbe_logs.h" #include "base/ixgbe_api.h" @@ -3339,6 +3340,7 @@ ixgbe_flow_destroy(struct rte_eth_dev *dev, struct ixgbe_hw_fdir_info *fdir_info = IXGBE_DEV_PRIVATE_TO_FDIR_INFO(dev->data->dev_private); struct ixgbe_rss_conf_ele *rss_filter_ptr; + void *tmp; switch (filter_type) { case RTE_ETH_FILTER_NTUPLE: @@ -3432,7 +3434,7 @@ ixgbe_flow_destroy(struct rte_eth_dev *dev, return ret; } - TAILQ_FOREACH(ixgbe_flow_mem_ptr, &ixgbe_flow_list, entries) { + TAILQ_FOREACH_SAFE(ixgbe_flow_mem_ptr, &ixgbe_flow_list, entries, tmp) { if (ixgbe_flow_mem_ptr->flow == pmd_flow) { TAILQ_REMOVE(&ixgbe_flow_list, ixgbe_flow_mem_ptr, entries); -- 2.27.0