From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id B134DA0C45 for ; Fri, 9 Jul 2021 04:49:14 +0200 (CEST) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id A5FB54165A; Fri, 9 Jul 2021 04:49:14 +0200 (CEST) Received: from mga01.intel.com (mga01.intel.com [192.55.52.88]) by mails.dpdk.org (Postfix) with ESMTP id 5DF5F40143; Fri, 9 Jul 2021 04:49:11 +0200 (CEST) X-IronPort-AV: E=McAfee;i="6200,9189,10039"; a="231400301" X-IronPort-AV: E=Sophos;i="5.84,225,1620716400"; d="scan'208";a="231400301" Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by fmsmga101.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 08 Jul 2021 19:49:10 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.84,225,1620716400"; d="scan'208";a="461963380" Received: from orsmsx606.amr.corp.intel.com ([10.22.229.19]) by fmsmga008.fm.intel.com with ESMTP; 08 Jul 2021 19:49:10 -0700 Received: from orsmsx612.amr.corp.intel.com (10.22.229.25) by ORSMSX606.amr.corp.intel.com (10.22.229.19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2242.10; Thu, 8 Jul 2021 19:49:09 -0700 Received: from ORSEDG601.ED.cps.intel.com (10.7.248.6) by orsmsx612.amr.corp.intel.com (10.22.229.25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2242.10 via Frontend Transport; Thu, 8 Jul 2021 19:49:09 -0700 Received: from NAM12-BN8-obe.outbound.protection.outlook.com (104.47.55.175) by edgegateway.intel.com (134.134.137.102) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.1.2242.4; Thu, 8 Jul 2021 19:49:09 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=EyLovKnf/B4XqA2pJmSFbeZNG+kCOKkRReJtXJqbGjYZ1PrZnlzkr1gzUfWQWLBHDdgM6Q/JGh25lc2lBz53K9WBVDQaZnrAIENuRBWMj8SoTlJaBN6tVnI/zJ6vZJuPlUjrZsm2up9OJ2UHNBLvvFFuEhEkQFaeuhE90/2OAgemmii3Hiou+L0UkRoOAxvH+6LnjOi8BF3bbH3EujuvC5iY3w9fL4WNUxmJUxKTj5YPt7QmKejPORcywUo8pH+j7xW94TDZIcnB2T2g7P4OAsc0SeXnaQlnhm8odGvzG8X6u2KXZXWeHqeF2Es0LtIACeoM1WlFcF/UHcDv4j04Og== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=5raTwqJPnpjCYgCX9Xoljf4RBXqmdQNnypZ3kA/Tcuc=; b=iifnAw7mTdRXmUZyJt7/qXqL+cUixvXfEg3I3r4C7f2ZqpyjJ/1MSwTtGvq9aOfxSZWY9FaQ9bMtn8yPEFbNRIRT8PD8hSO5PaQ70TyNGjvW7dKxn7UKp9NXpA2Snm2ukA6fUNLEqFGdopaA5b6zkOYx+lwU3nO5+JCcVe87PysytMRM4sNwcyKGSJjEgXO7xJoccfMCSSV6hA1Mhp83symdUCmizVKaV0WSEtUSYYT0890z6QfrgnDhDGf6jIml2YbhnszbqbX1j32TcTJ1Rw/eD0t0LksZtoNMFj6aSyoHBMgLgiw9ACAvIwU4UTIrIMJnhhSXTTGLfh062G0bFg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=intel.com; dmarc=pass action=none header.from=intel.com; dkim=pass header.d=intel.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=intel.onmicrosoft.com; s=selector2-intel-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=5raTwqJPnpjCYgCX9Xoljf4RBXqmdQNnypZ3kA/Tcuc=; b=SMA6eJBX7yjRYMm0udLEyKe7q7ZrWjvaZD3ePLpNEKOvo0BV6LgnYwh9XWsD3/lY/kg09nLTmlICibztq5tyWsvq6MwvY3MYYdAE0/fdxF4XhgJMynPBkIcoPfPo4qWsbfncwxWRtxuwoan95BXxUHn0vBmLX+14Mlu/2NyIEtg= Received: from BN8PR11MB3795.namprd11.prod.outlook.com (2603:10b6:408:82::31) by BN7PR11MB2529.namprd11.prod.outlook.com (2603:10b6:406:b3::29) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4219.24; Fri, 9 Jul 2021 02:49:08 +0000 Received: from BN8PR11MB3795.namprd11.prod.outlook.com ([fe80::8807:6661:e425:102]) by BN8PR11MB3795.namprd11.prod.outlook.com ([fe80::8807:6661:e425:102%7]) with mapi id 15.20.4308.023; Fri, 9 Jul 2021 02:49:08 +0000 From: "Wang, Haiyue" To: "Yu, DapengX" CC: "dev@dpdk.org" , "stable@dpdk.org" Thread-Topic: [PATCH] net/ixgbe: fix using heap pointer after free Thread-Index: AQHXdGqM7yk6tc0GFECsy5mcu2ZcY6s58IsQ Date: Fri, 9 Jul 2021 02:49:07 +0000 Message-ID: References: <20210709023022.847686-1-dapengx.yu@intel.com> In-Reply-To: <20210709023022.847686-1-dapengx.yu@intel.com> Accept-Language: zh-CN, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: dlp-product: dlpe-windows dlp-reaction: no-action dlp-version: 11.6.0.76 authentication-results: intel.com; dkim=none (message not signed) header.d=none;intel.com; dmarc=none action=none header.from=intel.com; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 8b1974f6-3a9f-47f4-0646-08d942841f73 x-ms-traffictypediagnostic: BN7PR11MB2529: x-ms-exchange-transport-forked: True x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8273; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: vCpvtspU7GDeH0ot9wJsEtSW3dbTKtYuj4UGNmwuDA/9BETgJAU1j+mDMqdvyzjYPbkZ4O1O8JHjnvERyfLF6dj3n5ba0ow9mIxLZemIlP5wXvG7XOvEM45OgYJ9cHuGnKNwZVZjEOfVwoGXaihWdZDWpMLs87Qd9B8J9RwM6RrAshkMPbLIu+RLk7b9On+iO7GdCtb+Ar3IFcLw5Rj7Ap0aNn4q7d//DSGtwTUitMuoz4vGIW1RMfcZgkuLheW1XJqU/EIAuyiGS/LAF4Y5H2HmNYwUzOjFpuQy1y++m6eMn7BT5W+XR1OrRfKURXBb8jFcDXCbQTxCoUa49DFquXrwjba1fL3ZAu2v1A6vfJBUy5MGpYyNDA37gHXa+deJr7B0MVkfyQqaWpLkmmBRrHyHWbGJrz64WfiqMLky5fjAJOoTCHhw9n9G5b3NzMU8oTggy1Vb09yydoAuZ1rXxsuHZDCEhZLYJg5mg5bBhUBn4wC13riv642Nvcl7k+6Ip6ZpFpvvR9nsmajihm7RWaCFLgjWdtKsX5TDRzFspK2qrIaHW/LXrZ3wyygBmjoZizBptKfewr3u69e2c5YvA2i5OIJ+akLsXuv7Rc9+kb/S3Oc6Ib7ZJwZk3e8Q3s0GNB4IL5u4JeXU74IpOozOwg== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BN8PR11MB3795.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFS:(39860400002)(366004)(376002)(346002)(136003)(396003)(55016002)(450100002)(186003)(71200400001)(38100700002)(6506007)(64756008)(54906003)(6862004)(76116006)(8936002)(122000001)(66946007)(4326008)(478600001)(86362001)(66476007)(53546011)(66556008)(33656002)(6636002)(8676002)(83380400001)(26005)(66446008)(2906002)(9686003)(52536014)(5660300002)(7696005)(316002); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?MLqwmEIXW72oEMOFuOHyBfglSh8BBhfJG48Gc2V+V0Sc6HINGN+Xk5vFMy12?= =?us-ascii?Q?Rb2npHdyoXQWC0p2I8aaXjLaLD3OeD95TFdxwcEyppukIoPCSH+xGshl3kCT?= =?us-ascii?Q?tGV0lxTpcXPmTIYGnD6O68zP8cdOvaxX6xsgdEWe7lRFuAUWinFpNwlXRKg8?= =?us-ascii?Q?Y5xIdU2lWgMcEFavA9CxB3JsFfO0drTBvC0ZnV+ayNAOofr5s3zGwkt9A8ga?= =?us-ascii?Q?7RQT/NXbowJ2BAgNSlUWAaemL194FxKuse9YPEPihWVXawkzeY6v9SuqLhDv?= =?us-ascii?Q?EbTAGq3agBgnX9KVk16tbpTQWAYB4NiGVB8DOjqKC+/CQS6YUcEVpRBeM/pQ?= =?us-ascii?Q?4rL9KfVl/f+3TanXe0MKR6yS/Xl2TjsOdrcYB9j+9rJYJqasgnv5bnxJRNvG?= =?us-ascii?Q?hh2Q8QSYLw/4Cv/x41RnQIMw9bqcI444BWhMNJMTtZ1JR4K+uYuG+NxGYd3q?= =?us-ascii?Q?Qb5iViD8wrJkt/AE6ra1aRmwNSoMjpk6hzrH+V1DKBUrEjyQxel/98kSzeDo?= =?us-ascii?Q?f8CsoPOR6Q44FI2FKw1yI76gYnJsSX2DOhOGavmIyVgliUywi7sjpcLGgISH?= =?us-ascii?Q?riuTHNtmNXLa6WFhYw0CqwrYcOoFwmoNZfLHeJDDt0CT7PXj/wSRHT4B32G8?= =?us-ascii?Q?WN57TT8nbRLW3F0q/Jdjz8XLKJttEPSF0vYpwORLFnk2ZSq4djXSgCcGRNIJ?= =?us-ascii?Q?S1QWi0tQoYJrN0VXCc95rl2ZJPSjcEIt0a/QeSfPu/GLc48JFCcKTad97nIA?= =?us-ascii?Q?VNFAcp1NRkjScgmnuGhzs2oKrOaySqCtCEOjodDHmJJymi8U0/V/We41FjFN?= =?us-ascii?Q?9WDt6eb/1qh8XKXwKuhiAjpOmahYZnkBhZaSdPU+s1yWR0nR0h/GbUPgNj4M?= =?us-ascii?Q?VKQCaIaj76rNDc+La15AQgjsR6mbW3vxbrqEQ/BHITjV4HtU/GcJmmO3iOoh?= =?us-ascii?Q?hByhs9yQ/LPwL5rMF3dw2VXDkU5Nf4sEHcAiANGrC6dz8vklgDvk+RgikQIl?= =?us-ascii?Q?SCgfb0kTcc1Hi8kIVZ3ODyd8yx/EUl61LUVHkFbsp+BVcdTZY/qlR7W/YOcx?= =?us-ascii?Q?2K3Tt5SOeDd9iWn7GBHpMPdCm5t3+e+KrKdhGS1eOUZUGzZaCOg+7jHq+nVf?= =?us-ascii?Q?NE3YNx3qVqDvaDGcgvGzAhzyVlm21ocDHoRvd40jiX0UoXmq59XlmPGyXE2e?= =?us-ascii?Q?aPlKeEvH4tlZUQNPJ1o7CCDxIr1pEzV+GWkLk8HnGF6inTAoYlBJol0w60wb?= =?us-ascii?Q?JvtKD8d89gbZv84XjEV7SKabkh6INzQzCK3DqdCTIF1udZxcO+NCexpTD6Wj?= =?us-ascii?Q?+GE=3D?= Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: BN8PR11MB3795.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 8b1974f6-3a9f-47f4-0646-08d942841f73 X-MS-Exchange-CrossTenant-originalarrivaltime: 09 Jul 2021 02:49:07.9304 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 46c98d88-e344-4ed4-8496-4ed7712e255d X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: rrmxB1Tc/tiM7ea3KjzsiHh3h43CFN6JYDkjjaieVgXkipYpqMiGuSvqixlWjICCPjPb7+uT60U/03L7+2AiVA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN7PR11MB2529 X-OriginatorOrg: intel.com Subject: Re: [dpdk-stable] [PATCH] net/ixgbe: fix using heap pointer after free X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: patches for DPDK stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: stable-bounces@dpdk.org Sender: "stable" > -----Original Message----- > From: Yu, DapengX > Sent: Friday, July 9, 2021 10:30 > To: Wang, Haiyue > Cc: dev@dpdk.org; Yu, DapengX ; stable@dpdk.org > Subject: [PATCH] net/ixgbe: fix using heap pointer after free >=20 > From: Dapeng Yu >=20 > The original code use a heap pointer after it is freed. > This patch fix it. >=20 > Fixes: a14de8b498d1 ("net/ixgbe: destroy consistent filter") > Cc: stable@dpdk.org >=20 > Signed-off-by: Dapeng Yu > --- > drivers/net/ixgbe/ixgbe_flow.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) >=20 > diff --git a/drivers/net/ixgbe/ixgbe_flow.c b/drivers/net/ixgbe/ixgbe_flo= w.c > index 0b10e91a9b..4db5ef4b2b 100644 > --- a/drivers/net/ixgbe/ixgbe_flow.c > +++ b/drivers/net/ixgbe/ixgbe_flow.c > @@ -32,6 +32,7 @@ > #include > #include > #include > +#include >=20 > #include "ixgbe_logs.h" > #include "base/ixgbe_api.h" > @@ -3339,6 +3340,7 @@ ixgbe_flow_destroy(struct rte_eth_dev *dev, > struct ixgbe_hw_fdir_info *fdir_info =3D > IXGBE_DEV_PRIVATE_TO_FDIR_INFO(dev->data->dev_private); > struct ixgbe_rss_conf_ele *rss_filter_ptr; > + void *tmp; >=20 > switch (filter_type) { > case RTE_ETH_FILTER_NTUPLE: > @@ -3432,7 +3434,7 @@ ixgbe_flow_destroy(struct rte_eth_dev *dev, > return ret; > } >=20 > - TAILQ_FOREACH(ixgbe_flow_mem_ptr, &ixgbe_flow_list, entries) { > + TAILQ_FOREACH_SAFE(ixgbe_flow_mem_ptr, &ixgbe_flow_list, entries, tmp) = { > if (ixgbe_flow_mem_ptr->flow =3D=3D pmd_flow) { > TAILQ_REMOVE(&ixgbe_flow_list, > ixgbe_flow_mem_ptr, entries); This is "find - free" process, and only one 'pmd_flow' in the list, so just "break;" is fine. TAILQ_FOREACH(ixgbe_flow_mem_ptr, &ixgbe_flow_list, entries) { if (ixgbe_flow_mem_ptr->flow =3D=3D pmd_flow) { TAILQ_REMOVE(&ixgbe_flow_list, ixgbe_flow_mem_ptr, entries); rte_free(ixgbe_flow_mem_ptr); break; <------ } } > -- > 2.27.0