From: Stephen Hemminger <stephen@networkplumber.org>
To: dev@dpdk.org
Cc: Stephen Hemminger <stephen@networkplumber.org>,
tianfei.zhang@intel.com, stable@dpdk.org,
Rosen Xu <rosen.xu@intel.com>, Andy Pei <andy.pei@intel.com>
Subject: [PATCH v2 13/16] raw/ifpga/base: fix use after free
Date: Sat, 28 Sep 2024 09:47:21 -0700 [thread overview]
Message-ID: <20240928164814.861933-14-stephen@networkplumber.org> (raw)
In-Reply-To: <20240928164814.861933-1-stephen@networkplumber.org>
The TAILQ_FOREACH() macro would refer to info after it
had been freed. Fix by introducing TAILQ_FOREACH_SAFE here.
Fixes: 4a19f89104f8 ("raw/ifpga/base: support multiple cards")
Cc: tianfei.zhang@intel.com
Cc: stable@dpdk.org
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
---
drivers/raw/ifpga/base/opae_intel_max10.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/raw/ifpga/base/opae_intel_max10.c b/drivers/raw/ifpga/base/opae_intel_max10.c
index dd97a5f9fd..d5a9ceb6e3 100644
--- a/drivers/raw/ifpga/base/opae_intel_max10.c
+++ b/drivers/raw/ifpga/base/opae_intel_max10.c
@@ -6,6 +6,13 @@
#include <libfdt.h>
#include "opae_osdep.h"
+#ifndef TAILQ_FOREACH_SAFE
+#define TAILQ_FOREACH_SAFE(var, head, field, tvar) \
+ for ((var) = TAILQ_FIRST((head)); \
+ (var) && ((tvar) = TAILQ_NEXT((var), field), 1); \
+ (var) = (tvar))
+#endif
+
int max10_sys_read(struct intel_max10_device *dev,
unsigned int offset, unsigned int *val)
{
@@ -746,9 +753,9 @@ static int fdt_get_named_reg(const void *fdt, int node, const char *name,
static void max10_sensor_uinit(struct intel_max10_device *dev)
{
- struct opae_sensor_info *info;
+ struct opae_sensor_info *info, *next;
- TAILQ_FOREACH(info, &dev->opae_sensor_list, node) {
+ TAILQ_FOREACH_SAFE(info, &dev->opae_sensor_list, node, next) {
TAILQ_REMOVE(&dev->opae_sensor_list, info, node);
opae_free(info);
}
--
2.45.2
next prev parent reply other threads:[~2024-09-28 16:49 UTC|newest]
Thread overview: 38+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-09-27 20:45 [PATCH 00/16] Fix allocation issues and add hardening Stephen Hemminger
2024-09-27 20:45 ` [PATCH 01/16] eal: add function attributes for allocation functions Stephen Hemminger
2024-09-27 22:09 ` David Marchand
2024-09-27 23:10 ` Stephen Hemminger
2024-09-27 20:45 ` [PATCH 02/16] memzone: fix use after free in tracing Stephen Hemminger
2024-09-27 20:45 ` [PATCH 03/16] cryptodev/bcmfs: fix mis-matched free Stephen Hemminger
2024-09-27 20:45 ` [PATCH 04/16] dma/ixd: fix incorrect free function in cleanup Stephen Hemminger
2024-09-27 20:45 ` [PATCH 05/16] event/cnxk: fix pointer mismatch " Stephen Hemminger
2024-09-27 20:45 ` [PATCH 06/16] examples/vhost: fix free function mismatch Stephen Hemminger
2024-09-27 20:45 ` [PATCH 07/16] net/cnxk: fix use-after-free Stephen Hemminger
2024-09-27 20:45 ` [PATCH 08/16] bpf: fix free mismatch if convert fails Stephen Hemminger
2024-09-27 20:45 ` [PATCH 09/16] net/e1000: fix use-after-free Stephen Hemminger
2024-09-27 20:45 ` [PATCH 10/16] net/sfc: fix use-after-free warning messages Stephen Hemminger
2024-09-28 11:52 ` Ivan Malov
2024-09-27 20:45 ` [PATCH 11/16] net/cpfl: fix free of nonheap object Stephen Hemminger
2024-09-27 20:45 ` [PATCH 12/16] raw/ifpga/base: fix use after free Stephen Hemminger
2024-09-27 20:45 ` [PATCH 13/16] common/qat: " Stephen Hemminger
2024-09-27 20:45 ` [PATCH 14/16] drivers/ifpga: fix free function mismatch Stephen Hemminger
2024-09-27 20:45 ` [PATCH 15/16] eal: add alloc_function attribute to rte_malloc Stephen Hemminger
2024-09-27 20:45 ` [PATCH 16/16] mempool: annotate mempool create Stephen Hemminger
2024-09-28 11:49 ` Morten Brørup
2024-09-28 16:47 ` [PATCH v2 00/16] Fix allocation bugs and add malloc hardening Stephen Hemminger
2024-09-28 16:47 ` [PATCH v2 01/16] eal: add function attributes for allocation functions Stephen Hemminger
2024-09-28 16:47 ` [PATCH v2 02/16] memzone: fix use after free in tracing Stephen Hemminger
2024-09-28 16:47 ` [PATCH v2 03/16] cryptodev/bcmfs: fix mis-matched free Stephen Hemminger
2024-09-28 16:47 ` [PATCH v2 04/16] dma/ixd: fix incorrect free function in cleanup Stephen Hemminger
2024-09-28 16:47 ` [PATCH v2 05/16] event/cnxk: fix pointer mismatch " Stephen Hemminger
2024-09-28 16:47 ` [PATCH v2 06/16] examples/vhost: fix free function mismatch Stephen Hemminger
2024-09-28 16:47 ` [PATCH v2 07/16] net/cnxk: fix use-after-free Stephen Hemminger
2024-09-28 16:47 ` [PATCH v2 08/16] bpf: fix free mismatch if convert fails Stephen Hemminger
2024-09-28 16:47 ` [PATCH v2 09/16] net/e1000: fix use-after-free Stephen Hemminger
2024-09-28 16:47 ` [PATCH v2 10/16] net/sfc: fix use-after-free warning messages Stephen Hemminger
2024-09-28 16:47 ` [PATCH v2 11/16] net/cpfl: fix free of nonheap object Stephen Hemminger
2024-09-28 16:47 ` [PATCH v2 12/16] net/nfp: fix duplicate call to rte_free Stephen Hemminger
2024-09-28 16:47 ` Stephen Hemminger [this message]
2024-09-28 16:47 ` [PATCH v2 14/16] common/qat: fix use after free Stephen Hemminger
2024-09-28 16:47 ` [PATCH v2 15/16] drivers/ifpga: fix free function mismatch Stephen Hemminger
2024-09-28 16:47 ` [PATCH v2 16/16] eal: add alloc_function attribute to rte_malloc Stephen Hemminger
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240928164814.861933-14-stephen@networkplumber.org \
--to=stephen@networkplumber.org \
--cc=andy.pei@intel.com \
--cc=dev@dpdk.org \
--cc=rosen.xu@intel.com \
--cc=stable@dpdk.org \
--cc=tianfei.zhang@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).