From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <dev-bounces@dpdk.org>
Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124])
	by inbox.dpdk.org (Postfix) with ESMTP id E4DC245A2C;
	Wed, 25 Sep 2024 18:32:53 +0200 (CEST)
Received: from mails.dpdk.org (localhost [127.0.0.1])
	by mails.dpdk.org (Postfix) with ESMTP id D33C44025D;
	Wed, 25 Sep 2024 18:32:53 +0200 (CEST)
Received: from inbox.dpdk.org (inbox.dpdk.org [95.142.172.178])
 by mails.dpdk.org (Postfix) with ESMTP id 5DB1F400EF
 for <dev@dpdk.org>; Wed, 25 Sep 2024 18:32:52 +0200 (CEST)
Received: by inbox.dpdk.org (Postfix, from userid 33)
 id 5862845A2D; Wed, 25 Sep 2024 18:32:52 +0200 (CEST)
From: bugzilla@dpdk.org
To: dev@dpdk.org
Subject: [DPDK/ethdev Bug 1551] use after free in Sfc driver
Date: Wed, 25 Sep 2024 16:32:52 +0000
X-Bugzilla-Reason: AssignedTo
X-Bugzilla-Type: new
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: DPDK
X-Bugzilla-Component: ethdev
X-Bugzilla-Version: unspecified
X-Bugzilla-Keywords: 
X-Bugzilla-Severity: normal
X-Bugzilla-Who: stephen@networkplumber.org
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Resolution: 
X-Bugzilla-Priority: Normal
X-Bugzilla-Assigned-To: dev@dpdk.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: bug_id short_desc product version rep_platform
 op_sys bug_status bug_severity priority component assigned_to reporter
 target_milestone
Message-ID: <bug-1551-3@http.bugs.dpdk.org/>
Content-Type: multipart/alternative; boundary=17272819720.ddbcDE9Fd.3555491
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://bugs.dpdk.org/
Auto-Submitted: auto-generated
X-Auto-Response-Suppress: All
MIME-Version: 1.0
X-BeenThere: dev@dpdk.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: DPDK patches and discussions <dev.dpdk.org>
List-Unsubscribe: <https://mails.dpdk.org/options/dev>,
 <mailto:dev-request@dpdk.org?subject=unsubscribe>
List-Archive: <http://mails.dpdk.org/archives/dev/>
List-Post: <mailto:dev@dpdk.org>
List-Help: <mailto:dev-request@dpdk.org?subject=help>
List-Subscribe: <https://mails.dpdk.org/listinfo/dev>,
 <mailto:dev-request@dpdk.org?subject=subscribe>
Errors-To: dev-bounces@dpdk.org


--17272819720.ddbcDE9Fd.3555491
Date: Wed, 25 Sep 2024 18:32:52 +0200
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://bugs.dpdk.org/
Auto-Submitted: auto-generated
X-Auto-Response-Suppress: All

https://bugs.dpdk.org/show_bug.cgi?id=3D1551

            Bug ID: 1551
           Summary: use after free in Sfc driver
           Product: DPDK
           Version: unspecified
          Hardware: All
                OS: All
            Status: UNCONFIRMED
          Severity: normal
          Priority: Normal
         Component: ethdev
          Assignee: dev@dpdk.org
          Reporter: stephen@networkplumber.org
  Target Milestone: ---

If GCC function attributes are added to rte_malloc, then it is able to spot=
 use
after free in several places.

1255/2957] Compiling C object
drivers/libtmp_rte_net_sfc.a.p/net_sfc_sfc_flow_rss.c.o
In file included from ../drivers/net/sfc/sfc.h:28,
                 from ../drivers/net/sfc/sfc_flow_rss.c:15:
../drivers/net/sfc/sfc_flow_rss.c: In function =E2=80=98sfc_flow_rss_ctx_de=
l=E2=80=99:
../drivers/net/sfc/sfc_log.h:38:17: warning: pointer =E2=80=98ctx=E2=80=99 =
used after
=E2=80=98rte_free=E2=80=99 [-Wuse-after-free]
   38 |                 rte_log(level, type,=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   39 |                         RTE_FMT("%s" RTE_FMT_HEAD(__VA_ARGS__ ,) "\=
n",=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   40 |                                 _sas->log_prefix,=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   41 |                                 RTE_FMT_TAIL(__VA_ARGS__,)));=20=20=
=20=20=20=20=20=20=20=20
\
      |                                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../drivers/net/sfc/sfc_log.h:80:17: note: in expansion of macro =E2=80=98SF=
C_LOG=E2=80=99
   80 |                 SFC_LOG(_sa->priv.shared, RTE_LOG_DEBUG,=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20
\
      |                 ^~~~~~~
../drivers/net/sfc/sfc_flow_rss.c:308:9: note: in expansion of macro =E2=80=
=98sfc_dbg=E2=80=99
  308 |         sfc_dbg(sa, "flow-rss: deleted ctx=3D%p", ctx);
      |         ^~~~~~~
../drivers/net/sfc/sfc_flow_rss.c:306:9: note: call to =E2=80=98rte_free=E2=
=80=99 here
  306 |         rte_free(ctx);
      |         ^~~~~~~~~~~~~
[1262/2957] Compiling C object
drivers/libtmp_rte_net_sfc.a.p/net_sfc_sfc_mae.c.o
In file included from ../drivers/net/sfc/sfc.h:28,
                 from ../drivers/net/sfc/sfc_mae.c:19:
../drivers/net/sfc/sfc_mae.c: In function =E2=80=98sfc_mae_encap_header_del=
=E2=80=99:
../drivers/net/sfc/sfc_log.h:38:17: warning: pointer =E2=80=98encap_header=
=E2=80=99 used after
=E2=80=98rte_free=E2=80=99 [-Wuse-after-free]
   38 |                 rte_log(level, type,=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   39 |                         RTE_FMT("%s" RTE_FMT_HEAD(__VA_ARGS__ ,) "\=
n",=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   40 |                                 _sas->log_prefix,=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   41 |                                 RTE_FMT_TAIL(__VA_ARGS__,)));=20=20=
=20=20=20=20=20=20=20=20
\
      |                                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../drivers/net/sfc/sfc_log.h:80:17: note: in expansion of macro =E2=80=98SF=
C_LOG=E2=80=99
   80 |                 SFC_LOG(_sa->priv.shared, RTE_LOG_DEBUG,=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20
\
      |                 ^~~~~~~
../drivers/net/sfc/sfc_mae.c:791:9: note: in expansion of macro =E2=80=98sf=
c_dbg=E2=80=99
  791 |         sfc_dbg(sa, "deleted encap_header=3D%p", encap_header);
      |         ^~~~~~~
../drivers/net/sfc/sfc_mae.c:789:9: note: call to =E2=80=98rte_free=E2=80=
=99 here
  789 |         rte_free(encap_header);
      |         ^~~~~~~~~~~~~~~~~~~~~~
../drivers/net/sfc/sfc_mae.c: In function =E2=80=98sfc_mae_mac_addr_del=E2=
=80=99:
../drivers/net/sfc/sfc_log.h:38:17: warning: pointer =E2=80=98mac_addr=E2=
=80=99 used after
=E2=80=98rte_free=E2=80=99 [-Wuse-after-free]
   38 |                 rte_log(level, type,=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   39 |                         RTE_FMT("%s" RTE_FMT_HEAD(__VA_ARGS__ ,) "\=
n",=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   40 |                                 _sas->log_prefix,=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   41 |                                 RTE_FMT_TAIL(__VA_ARGS__,)));=20=20=
=20=20=20=20=20=20=20=20
\
      |                                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../drivers/net/sfc/sfc_log.h:80:17: note: in expansion of macro =E2=80=98SF=
C_LOG=E2=80=99
   80 |                 SFC_LOG(_sa->priv.shared, RTE_LOG_DEBUG,=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20
\
      |                 ^~~~~~~
../drivers/net/sfc/sfc_mae.c:590:9: note: in expansion of macro =E2=80=98sf=
c_dbg=E2=80=99
  590 |         sfc_dbg(sa, "deleted mac_addr=3D%p", mac_addr);
      |         ^~~~~~~
../drivers/net/sfc/sfc_mae.c:588:9: note: call to =E2=80=98rte_free=E2=80=
=99 here
  588 |         rte_free(mac_addr);
      |         ^~~~~~~~~~~~~~~~~~
../drivers/net/sfc/sfc_mae.c: In function =E2=80=98sfc_mae_outer_rule_del=
=E2=80=99:
../drivers/net/sfc/sfc_log.h:38:17: warning: pointer =E2=80=98rule=E2=80=99=
 used after
=E2=80=98rte_free=E2=80=99 [-Wuse-after-free]
   38 |                 rte_log(level, type,=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   39 |                         RTE_FMT("%s" RTE_FMT_HEAD(__VA_ARGS__ ,) "\=
n",=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   40 |                                 _sas->log_prefix,=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   41 |                                 RTE_FMT_TAIL(__VA_ARGS__,)));=20=20=
=20=20=20=20=20=20=20=20
\
      |                                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../drivers/net/sfc/sfc_log.h:80:17: note: in expansion of macro =E2=80=98SF=
C_LOG=E2=80=99
   80 |                 SFC_LOG(_sa->priv.shared, RTE_LOG_DEBUG,=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20
\
      |                 ^~~~~~~
../drivers/net/sfc/sfc_mae.c:405:9: note: in expansion of macro =E2=80=98sf=
c_dbg=E2=80=99
  405 |         sfc_dbg(sa, "deleted outer_rule=3D%p", rule);
      |         ^~~~~~~
../drivers/net/sfc/sfc_mae.c:403:9: note: call to =E2=80=98rte_free=E2=80=
=99 here
  403 |         rte_free(rule);
      |         ^~~~~~~~~~~~~~
../drivers/net/sfc/sfc_mae.c: In function =E2=80=98sfc_mae_counter_del=E2=
=80=99:
../drivers/net/sfc/sfc_log.h:38:17: warning: pointer =E2=80=98counter=E2=80=
=99 used after
=E2=80=98rte_free=E2=80=99 [-Wuse-after-free]
   38 |                 rte_log(level, type,=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   39 |                         RTE_FMT("%s" RTE_FMT_HEAD(__VA_ARGS__ ,) "\=
n",=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   40 |                                 _sas->log_prefix,=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   41 |                                 RTE_FMT_TAIL(__VA_ARGS__,)));=20=20=
=20=20=20=20=20=20=20=20
\
      |                                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../drivers/net/sfc/sfc_log.h:80:17: note: in expansion of macro =E2=80=98SF=
C_LOG=E2=80=99
   80 |                 SFC_LOG(_sa->priv.shared, RTE_LOG_DEBUG,=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20
\
      |                 ^~~~~~~
../drivers/net/sfc/sfc_mae.c:988:9: note: in expansion of macro =E2=80=98sf=
c_dbg=E2=80=99
  988 |         sfc_dbg(sa, "deleted counter=3D%p", counter);
      |         ^~~~~~~
../drivers/net/sfc/sfc_mae.c:986:9: note: call to =E2=80=98rte_free=E2=80=
=99 here
  986 |         rte_free(counter);
      |         ^~~~~~~~~~~~~~~~~
../drivers/net/sfc/sfc_mae.c: In function =E2=80=98sfc_mae_action_set_del=
=E2=80=99:
../drivers/net/sfc/sfc_log.h:38:17: warning: pointer =E2=80=98action_set=E2=
=80=99 used after
=E2=80=98rte_free=E2=80=99 [-Wuse-after-free]
   38 |                 rte_log(level, type,=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   39 |                         RTE_FMT("%s" RTE_FMT_HEAD(__VA_ARGS__ ,) "\=
n",=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   40 |                                 _sas->log_prefix,=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   41 |                                 RTE_FMT_TAIL(__VA_ARGS__,)));=20=20=
=20=20=20=20=20=20=20=20
\
      |                                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../drivers/net/sfc/sfc_log.h:80:17: note: in expansion of macro =E2=80=98SF=
C_LOG=E2=80=99
   80 |                 SFC_LOG(_sa->priv.shared, RTE_LOG_DEBUG,=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20
\
      |                 ^~~~~~~
../drivers/net/sfc/sfc_mae.c:1170:9: note: in expansion of macro =E2=80=98s=
fc_dbg=E2=80=99
 1170 |         sfc_dbg(sa, "deleted action_set=3D%p", action_set);
      |         ^~~~~~~
../drivers/net/sfc/sfc_mae.c:1168:9: note: call to =E2=80=98rte_free=E2=80=
=99 here
 1168 |         rte_free(action_set);
      |         ^~~~~~~~~~~~~~~~~~~~
../drivers/net/sfc/sfc_mae.c: In function =E2=80=98sfc_mae_action_set_list_=
del=E2=80=99:
../drivers/net/sfc/sfc_log.h:38:17: warning: pointer =E2=80=98action_set_li=
st=E2=80=99 used
after =E2=80=98rte_free=E2=80=99 [-Wuse-after-free]
   38 |                 rte_log(level, type,=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   39 |                         RTE_FMT("%s" RTE_FMT_HEAD(__VA_ARGS__ ,) "\=
n",=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   40 |                                 _sas->log_prefix,=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   41 |                                 RTE_FMT_TAIL(__VA_ARGS__,)));=20=20=
=20=20=20=20=20=20=20=20
\
      |                                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../drivers/net/sfc/sfc_log.h:80:17: note: in expansion of macro =E2=80=98SF=
C_LOG=E2=80=99
   80 |                 SFC_LOG(_sa->priv.shared, RTE_LOG_DEBUG,=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20
\
      |                 ^~~~~~~
../drivers/net/sfc/sfc_mae.c:1407:9: note: in expansion of macro =E2=80=98s=
fc_dbg=E2=80=99
 1407 |         sfc_dbg(sa, "deleted action_set_list=3D%p", action_set_list=
);
      |         ^~~~~~~
../drivers/net/sfc/sfc_mae.c:1405:9: note: call to =E2=80=98rte_free=E2=80=
=99 here
 1405 |         rte_free(action_set_list);
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~
../drivers/net/sfc/sfc_mae.c: In function =E2=80=98sfc_mae_action_rule_del=
=E2=80=99:
../drivers/net/sfc/sfc_log.h:38:17: warning: pointer =E2=80=98rule=E2=80=99=
 used after
=E2=80=98rte_free=E2=80=99 [-Wuse-after-free]
   38 |                 rte_log(level, type,=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   39 |                         RTE_FMT("%s" RTE_FMT_HEAD(__VA_ARGS__ ,) "\=
n",=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   40 |                                 _sas->log_prefix,=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   41 |                                 RTE_FMT_TAIL(__VA_ARGS__,)));=20=20=
=20=20=20=20=20=20=20=20
\
      |                                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../drivers/net/sfc/sfc_log.h:80:17: note: in expansion of macro =E2=80=98SF=
C_LOG=E2=80=99
   80 |                 SFC_LOG(_sa->priv.shared, RTE_LOG_DEBUG,=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20
\
      |                 ^~~~~~~
../drivers/net/sfc/sfc_mae.c:1672:9: note: in expansion of macro =E2=80=98s=
fc_dbg=E2=80=99
 1672 |         sfc_dbg(sa, "deleted action_rule=3D%p", rule);
      |         ^~~~~~~
../drivers/net/sfc/sfc_mae.c:1670:9: note: call to =E2=80=98rte_free=E2=80=
=99 here
 1670 |         rte_free(rule);
      |         ^~~~~~~~~~~~~~

--=20
You are receiving this mail because:
You are the assignee for the bug.=

--17272819720.ddbcDE9Fd.3555491
Date: Wed, 25 Sep 2024 18:32:52 +0200
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://bugs.dpdk.org/
Auto-Submitted: auto-generated
X-Auto-Response-Suppress: All

<html>
    <head>
      <base href=3D"https://bugs.dpdk.org/">
    </head>
    <body><table border=3D"1" cellspacing=3D"0" cellpadding=3D"8" class=3D"=
bz_new_table">
        <tr>
          <th>Bug ID</th>
          <td><a class=3D"bz_bug_link=20
          bz_status_UNCONFIRMED "
   title=3D"UNCONFIRMED - use after free in Sfc driver"
   href=3D"https://bugs.dpdk.org/show_bug.cgi?id=3D1551">1551</a>
          </td>
        </tr>

        <tr>
          <th>Summary</th>
          <td>use after free in Sfc driver
          </td>
        </tr>

        <tr>
          <th>Product</th>
          <td>DPDK
          </td>
        </tr>

        <tr>
          <th>Version</th>
          <td>unspecified
          </td>
        </tr>

        <tr>
          <th>Hardware</th>
          <td>All
          </td>
        </tr>

        <tr>
          <th>OS</th>
          <td>All
          </td>
        </tr>

        <tr>
          <th>Status</th>
          <td>UNCONFIRMED
          </td>
        </tr>

        <tr>
          <th>Severity</th>
          <td>normal
          </td>
        </tr>

        <tr>
          <th>Priority</th>
          <td>Normal
          </td>
        </tr>

        <tr>
          <th>Component</th>
          <td>ethdev
          </td>
        </tr>

        <tr>
          <th>Assignee</th>
          <td>dev&#64;dpdk.org
          </td>
        </tr>

        <tr>
          <th>Reporter</th>
          <td>stephen&#64;networkplumber.org
          </td>
        </tr>

        <tr>
          <th>Target Milestone</th>
          <td>---
          </td>
        </tr></table>
      <p>
        <div class=3D"bz_comment_block">
          <pre class=3D"bz_comment_text">If GCC function attributes are add=
ed to rte_malloc, then it is able to spot use
after free in several places.

1255/2957] Compiling C object
drivers/libtmp_rte_net_sfc.a.p/net_sfc_sfc_flow_rss.c.o
In file included from ../drivers/net/sfc/sfc.h:28,
                 from ../drivers/net/sfc/sfc_flow_rss.c:15:
../drivers/net/sfc/sfc_flow_rss.c: In function =E2=80=98sfc_flow_rss_ctx_de=
l=E2=80=99:
../drivers/net/sfc/sfc_log.h:38:17: warning: pointer =E2=80=98ctx=E2=80=99 =
used after
=E2=80=98rte_free=E2=80=99 [-Wuse-after-free]
   38 |                 rte_log(level, type,=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   39 |                         RTE_FMT(&quot;%s&quot; RTE_FMT_HEAD(__VA_AR=
GS__ ,) &quot;\n&quot;,=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   40 |                                 _sas-&gt;log_prefix,=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   41 |                                 RTE_FMT_TAIL(__VA_ARGS__,)));=20=20=
=20=20=20=20=20=20=20=20
\
      |                                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../drivers/net/sfc/sfc_log.h:80:17: note: in expansion of macro =E2=80=98SF=
C_LOG=E2=80=99
   80 |                 SFC_LOG(_sa-&gt;priv.shared, RTE_LOG_DEBUG,=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20
\
      |                 ^~~~~~~
../drivers/net/sfc/sfc_flow_rss.c:308:9: note: in expansion of macro =E2=80=
=98sfc_dbg=E2=80=99
  308 |         sfc_dbg(sa, &quot;flow-rss: deleted ctx=3D%p&quot;, ctx);
      |         ^~~~~~~
../drivers/net/sfc/sfc_flow_rss.c:306:9: note: call to =E2=80=98rte_free=E2=
=80=99 here
  306 |         rte_free(ctx);
      |         ^~~~~~~~~~~~~
[1262/2957] Compiling C object
drivers/libtmp_rte_net_sfc.a.p/net_sfc_sfc_mae.c.o
In file included from ../drivers/net/sfc/sfc.h:28,
                 from ../drivers/net/sfc/sfc_mae.c:19:
../drivers/net/sfc/sfc_mae.c: In function =E2=80=98sfc_mae_encap_header_del=
=E2=80=99:
../drivers/net/sfc/sfc_log.h:38:17: warning: pointer =E2=80=98encap_header=
=E2=80=99 used after
=E2=80=98rte_free=E2=80=99 [-Wuse-after-free]
   38 |                 rte_log(level, type,=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   39 |                         RTE_FMT(&quot;%s&quot; RTE_FMT_HEAD(__VA_AR=
GS__ ,) &quot;\n&quot;,=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   40 |                                 _sas-&gt;log_prefix,=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   41 |                                 RTE_FMT_TAIL(__VA_ARGS__,)));=20=20=
=20=20=20=20=20=20=20=20
\
      |                                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../drivers/net/sfc/sfc_log.h:80:17: note: in expansion of macro =E2=80=98SF=
C_LOG=E2=80=99
   80 |                 SFC_LOG(_sa-&gt;priv.shared, RTE_LOG_DEBUG,=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20
\
      |                 ^~~~~~~
../drivers/net/sfc/sfc_mae.c:791:9: note: in expansion of macro =E2=80=98sf=
c_dbg=E2=80=99
  791 |         sfc_dbg(sa, &quot;deleted encap_header=3D%p&quot;, encap_he=
ader);
      |         ^~~~~~~
../drivers/net/sfc/sfc_mae.c:789:9: note: call to =E2=80=98rte_free=E2=80=
=99 here
  789 |         rte_free(encap_header);
      |         ^~~~~~~~~~~~~~~~~~~~~~
../drivers/net/sfc/sfc_mae.c: In function =E2=80=98sfc_mae_mac_addr_del=E2=
=80=99:
../drivers/net/sfc/sfc_log.h:38:17: warning: pointer =E2=80=98mac_addr=E2=
=80=99 used after
=E2=80=98rte_free=E2=80=99 [-Wuse-after-free]
   38 |                 rte_log(level, type,=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   39 |                         RTE_FMT(&quot;%s&quot; RTE_FMT_HEAD(__VA_AR=
GS__ ,) &quot;\n&quot;,=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   40 |                                 _sas-&gt;log_prefix,=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   41 |                                 RTE_FMT_TAIL(__VA_ARGS__,)));=20=20=
=20=20=20=20=20=20=20=20
\
      |                                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../drivers/net/sfc/sfc_log.h:80:17: note: in expansion of macro =E2=80=98SF=
C_LOG=E2=80=99
   80 |                 SFC_LOG(_sa-&gt;priv.shared, RTE_LOG_DEBUG,=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20
\
      |                 ^~~~~~~
../drivers/net/sfc/sfc_mae.c:590:9: note: in expansion of macro =E2=80=98sf=
c_dbg=E2=80=99
  590 |         sfc_dbg(sa, &quot;deleted mac_addr=3D%p&quot;, mac_addr);
      |         ^~~~~~~
../drivers/net/sfc/sfc_mae.c:588:9: note: call to =E2=80=98rte_free=E2=80=
=99 here
  588 |         rte_free(mac_addr);
      |         ^~~~~~~~~~~~~~~~~~
../drivers/net/sfc/sfc_mae.c: In function =E2=80=98sfc_mae_outer_rule_del=
=E2=80=99:
../drivers/net/sfc/sfc_log.h:38:17: warning: pointer =E2=80=98rule=E2=80=99=
 used after
=E2=80=98rte_free=E2=80=99 [-Wuse-after-free]
   38 |                 rte_log(level, type,=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   39 |                         RTE_FMT(&quot;%s&quot; RTE_FMT_HEAD(__VA_AR=
GS__ ,) &quot;\n&quot;,=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   40 |                                 _sas-&gt;log_prefix,=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   41 |                                 RTE_FMT_TAIL(__VA_ARGS__,)));=20=20=
=20=20=20=20=20=20=20=20
\
      |                                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../drivers/net/sfc/sfc_log.h:80:17: note: in expansion of macro =E2=80=98SF=
C_LOG=E2=80=99
   80 |                 SFC_LOG(_sa-&gt;priv.shared, RTE_LOG_DEBUG,=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20
\
      |                 ^~~~~~~
../drivers/net/sfc/sfc_mae.c:405:9: note: in expansion of macro =E2=80=98sf=
c_dbg=E2=80=99
  405 |         sfc_dbg(sa, &quot;deleted outer_rule=3D%p&quot;, rule);
      |         ^~~~~~~
../drivers/net/sfc/sfc_mae.c:403:9: note: call to =E2=80=98rte_free=E2=80=
=99 here
  403 |         rte_free(rule);
      |         ^~~~~~~~~~~~~~
../drivers/net/sfc/sfc_mae.c: In function =E2=80=98sfc_mae_counter_del=E2=
=80=99:
../drivers/net/sfc/sfc_log.h:38:17: warning: pointer =E2=80=98counter=E2=80=
=99 used after
=E2=80=98rte_free=E2=80=99 [-Wuse-after-free]
   38 |                 rte_log(level, type,=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   39 |                         RTE_FMT(&quot;%s&quot; RTE_FMT_HEAD(__VA_AR=
GS__ ,) &quot;\n&quot;,=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   40 |                                 _sas-&gt;log_prefix,=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   41 |                                 RTE_FMT_TAIL(__VA_ARGS__,)));=20=20=
=20=20=20=20=20=20=20=20
\
      |                                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../drivers/net/sfc/sfc_log.h:80:17: note: in expansion of macro =E2=80=98SF=
C_LOG=E2=80=99
   80 |                 SFC_LOG(_sa-&gt;priv.shared, RTE_LOG_DEBUG,=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20
\
      |                 ^~~~~~~
../drivers/net/sfc/sfc_mae.c:988:9: note: in expansion of macro =E2=80=98sf=
c_dbg=E2=80=99
  988 |         sfc_dbg(sa, &quot;deleted counter=3D%p&quot;, counter);
      |         ^~~~~~~
../drivers/net/sfc/sfc_mae.c:986:9: note: call to =E2=80=98rte_free=E2=80=
=99 here
  986 |         rte_free(counter);
      |         ^~~~~~~~~~~~~~~~~
../drivers/net/sfc/sfc_mae.c: In function =E2=80=98sfc_mae_action_set_del=
=E2=80=99:
../drivers/net/sfc/sfc_log.h:38:17: warning: pointer =E2=80=98action_set=E2=
=80=99 used after
=E2=80=98rte_free=E2=80=99 [-Wuse-after-free]
   38 |                 rte_log(level, type,=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   39 |                         RTE_FMT(&quot;%s&quot; RTE_FMT_HEAD(__VA_AR=
GS__ ,) &quot;\n&quot;,=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   40 |                                 _sas-&gt;log_prefix,=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   41 |                                 RTE_FMT_TAIL(__VA_ARGS__,)));=20=20=
=20=20=20=20=20=20=20=20
\
      |                                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../drivers/net/sfc/sfc_log.h:80:17: note: in expansion of macro =E2=80=98SF=
C_LOG=E2=80=99
   80 |                 SFC_LOG(_sa-&gt;priv.shared, RTE_LOG_DEBUG,=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20
\
      |                 ^~~~~~~
../drivers/net/sfc/sfc_mae.c:1170:9: note: in expansion of macro =E2=80=98s=
fc_dbg=E2=80=99
 1170 |         sfc_dbg(sa, &quot;deleted action_set=3D%p&quot;, action_set=
);
      |         ^~~~~~~
../drivers/net/sfc/sfc_mae.c:1168:9: note: call to =E2=80=98rte_free=E2=80=
=99 here
 1168 |         rte_free(action_set);
      |         ^~~~~~~~~~~~~~~~~~~~
../drivers/net/sfc/sfc_mae.c: In function =E2=80=98sfc_mae_action_set_list_=
del=E2=80=99:
../drivers/net/sfc/sfc_log.h:38:17: warning: pointer =E2=80=98action_set_li=
st=E2=80=99 used
after =E2=80=98rte_free=E2=80=99 [-Wuse-after-free]
   38 |                 rte_log(level, type,=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   39 |                         RTE_FMT(&quot;%s&quot; RTE_FMT_HEAD(__VA_AR=
GS__ ,) &quot;\n&quot;,=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   40 |                                 _sas-&gt;log_prefix,=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   41 |                                 RTE_FMT_TAIL(__VA_ARGS__,)));=20=20=
=20=20=20=20=20=20=20=20
\
      |                                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../drivers/net/sfc/sfc_log.h:80:17: note: in expansion of macro =E2=80=98SF=
C_LOG=E2=80=99
   80 |                 SFC_LOG(_sa-&gt;priv.shared, RTE_LOG_DEBUG,=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20
\
      |                 ^~~~~~~
../drivers/net/sfc/sfc_mae.c:1407:9: note: in expansion of macro =E2=80=98s=
fc_dbg=E2=80=99
 1407 |         sfc_dbg(sa, &quot;deleted action_set_list=3D%p&quot;, actio=
n_set_list);
      |         ^~~~~~~
../drivers/net/sfc/sfc_mae.c:1405:9: note: call to =E2=80=98rte_free=E2=80=
=99 here
 1405 |         rte_free(action_set_list);
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~
../drivers/net/sfc/sfc_mae.c: In function =E2=80=98sfc_mae_action_rule_del=
=E2=80=99:
../drivers/net/sfc/sfc_log.h:38:17: warning: pointer =E2=80=98rule=E2=80=99=
 used after
=E2=80=98rte_free=E2=80=99 [-Wuse-after-free]
   38 |                 rte_log(level, type,=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   39 |                         RTE_FMT(&quot;%s&quot; RTE_FMT_HEAD(__VA_AR=
GS__ ,) &quot;\n&quot;,=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   40 |                                 _sas-&gt;log_prefix,=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
\
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   41 |                                 RTE_FMT_TAIL(__VA_ARGS__,)));=20=20=
=20=20=20=20=20=20=20=20
\
      |                                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../drivers/net/sfc/sfc_log.h:80:17: note: in expansion of macro =E2=80=98SF=
C_LOG=E2=80=99
   80 |                 SFC_LOG(_sa-&gt;priv.shared, RTE_LOG_DEBUG,=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20
\
      |                 ^~~~~~~
../drivers/net/sfc/sfc_mae.c:1672:9: note: in expansion of macro =E2=80=98s=
fc_dbg=E2=80=99
 1672 |         sfc_dbg(sa, &quot;deleted action_rule=3D%p&quot;, rule);
      |         ^~~~~~~
../drivers/net/sfc/sfc_mae.c:1670:9: note: call to =E2=80=98rte_free=E2=80=
=99 here
 1670 |         rte_free(rule);
      |         ^~~~~~~~~~~~~~
          </pre>
        </div>
      </p>


      <hr>
      <span>You are receiving this mail because:</span>

      <ul>
          <li>You are the assignee for the bug.</li>
      </ul>
      <div itemscope itemtype=3D"http://schema.org/EmailMessage">
        <div itemprop=3D"action" itemscope itemtype=3D"http://schema.org/Vi=
ewAction">
=20=20=20=20=20=20=20=20=20=20
          <link itemprop=3D"url" href=3D"https://bugs.dpdk.org/show_bug.cgi=
?id=3D1551">
          <meta itemprop=3D"name" content=3D"View bug">
        </div>
        <meta itemprop=3D"description" content=3D"Bugzilla bug update notif=
ication">
      </div>
    </body>
</html>=

--17272819720.ddbcDE9Fd.3555491--