net/ixgbe: fix using heap pointer after free
PATCH 1/1 net/ixgbe: fix using heap pointer after free
From: Dapeng Yu <[email protected]>
The original code use a heap pointer after it is freed. This patch fix it.
--- drivers/net/ixgbe/ixgbe_flow.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ixgbe/ixgbe_flow.c +3 -1
@@ -32,6 +32,7 @@#include <rte_hash_crc.h> #include <rte_flow.h> #include <rte_flow_driver.h> +#include <rte_tailq.h> #include "ixgbe_logs.h" #include "base/ixgbe_api.h"
@@ -3339,6 +3340,7 @@ ixgbe_flow_destroy(struct rte_eth_dev *dev,struct ixgbe_hw_fdir_info *fdir_info =IXGBE_DEV_PRIVATE_TO_FDIR_INFO (dev->data->dev_private);struct ixgbe_rss_conf_ele *rss_filter_ptr; +void *tmp;switch (filter_type) {case RTE_ETH_FILTER_NTUPLE :
@@ -3432,7 +3434,7 @@ ixgbe_flow_destroy(struct rte_eth_dev *dev,return ret; } - TAILQ_FOREACH(ixgbe_flow_mem_ptr, &ixgbe_flow_list, entries) { + TAILQ_FOREACH_SAFE(ixgbe_flow_mem_ptr, &ixgbe_flow_list, entries, tmp) {if (ixgbe_flow_mem_ptr->flow == pmd_flow) {TAILQ_REMOVE (&ixgbe_flow_list, ixgbe_flow_mem_ptr, entries);
Signature · 1 line
2.27.0
Quoted 41 lines
-----Original Message-----
From: Yu, DapengX <[email protected]>
Sent: Friday, July 9, 2021 10:30
To: Wang, Haiyue <[email protected]>
Cc: [email protected]; Yu, DapengX <[email protected]>; [email protected]
Subject: [PATCH] net/ixgbe: fix using heap pointer after freeFrom: Dapeng Yu <[email protected]>
The original code use a heap pointer after it is freed. This patch fix it.
Fixes a14de8b498d1 ("net/ixgbe: destroy consistent filter")Signed-off-by Dapeng Yu <[email protected]>--- drivers/net/ixgbe/ixgbe_flow.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)drivers/net/ixgbe/ixgbe_flow.c +2
-0@@ -32,6 +32,7 @@#include <rte_hash_crc.h> #include <rte_flow.h> #include <rte_flow_driver.h> +#include <rte_tailq.h> #include "ixgbe_logs.h" #include "base/ixgbe_api.h" @@ -3339,6 +3340,7 @@ ixgbe_flow_destroy(struct rte_eth_dev *dev,struct ixgbe_hw_fdir_info *fdir_info =IXGBE_DEV_PRIVATE_TO_FDIR_INFO (dev->data->dev_private);struct ixgbe_rss_conf_ele *rss_filter_ptr; +void *tmp;switch (filter_type) {case RTE_ETH_FILTER_NTUPLE :
drivers/net/ixgbe/ixgbe_flow.c ixgbe_flow_destroy(struct rte_eth_dev *dev, · line 3440
Quoted 8 lines
drivers/net/ixgbe/ixgbe_flow.c +1
-1@@ -3432,7 +3434,7 @@ ixgbe_flow_destroy(struct rte_eth_dev *dev,return ret; } - TAILQ_FOREACH(ixgbe_flow_mem_ptr, &ixgbe_flow_list, entries) { + TAILQ_FOREACH_SAFE(ixgbe_flow_mem_ptr, &ixgbe_flow_list, entries, tmp) {if (ixgbe_flow_mem_ptr->flow == pmd_flow) {TAILQ_REMOVE (&ixgbe_flow_list, ixgbe_flow_mem_ptr, entries);
This is "find - free" process, and only one 'pmd_flow' in the list, so just "break;" is fine.
TAILQ_FOREACH(ixgbe_flow_mem_ptr, &ixgbe_flow_list, entries) {
if (ixgbe_flow_mem_ptr->flow == pmd_flow) {
TAILQ_REMOVE(&ixgbe_flow_list,
ixgbe_flow_mem_ptr, entries);
rte_free(ixgbe_flow_mem_ptr);
break; <------
}
}Quoted 2 lines
--
2.27.0
PATCH v2 1/1 net/ixgbe: fix using heap pointer after free
In reply to [email protected]From: Dapeng Yu <[email protected]>
The original code use a heap pointer after it is freed. This patch fix it.
---
V2:
* Simplify the patch according to maintainer's comment:
only one "pmd_flow" in the list, so just "break;" is fine.
--- drivers/net/ixgbe/ixgbe_flow.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ixgbe/ixgbe_flow.c +1 -0
@@ -3437,6 +3437,7 @@ ixgbe_flow_destroy(struct rte_eth_dev *dev,TAILQ_REMOVE (&ixgbe_flow_list, ixgbe_flow_mem_ptr, entries);rte_free (ixgbe_flow_mem_ptr); +break ; } }rte_free (flow);
Signature · 1 line
2.27.0
Quoted 15 lines
-----Original Message-----
From: Yu, DapengX <[email protected]>
Sent: Friday, July 9, 2021 11:15
To: Wang, Haiyue <[email protected]>
Cc: [email protected]; Yu, DapengX <[email protected]>; [email protected]
Subject: [PATCH v2] net/ixgbe: fix using heap pointer after freeFrom: Dapeng Yu <[email protected]>
The original code use a heap pointer after it is freed. This patch fix it.
Fixes a14de8b498d1 ("net/ixgbe: destroy consistent filter")
Quoted 9 lines
Signed-off-by Dapeng Yu <[email protected]>---
V2:
* Simplify the patch according to maintainer's comment:
only one "pmd_flow" in the list, so just "break;" is fine.--- drivers/net/ixgbe/ixgbe_flow.c | 1 + 1 file changed, 1 insertion(+)
Good catch, thanks!
Quoted 2 lines
--
2.27.0
Zhang, Qi Z
AppliedQuoted 34 lines
-----Original Message-----
From: dev <[email protected]> On Behalf Of Wang, Haiyue
Sent: Friday, July 9, 2021 12:35 PM
To: Yu, DapengX <[email protected]>
Cc: [email protected]; [email protected]
Subject: Re: [dpdk-dev] [PATCH v2] net/ixgbe: fix using heap pointer after freeQuoted 15 lines
-----Original Message-----
From: Yu, DapengX <[email protected]>
Sent: Friday, July 9, 2021 11:15
To: Wang, Haiyue <[email protected]>
Cc: [email protected]; Yu, DapengX <[email protected]>; [email protected]
Subject: [PATCH v2] net/ixgbe: fix using heap pointer after freeFrom: Dapeng Yu <[email protected]>
The original code use a heap pointer after it is freed. This patch fix it.
Fixes a14de8b498d1 ("net/ixgbe: destroy consistent filter")Quoted 9 lines
Signed-off-by Dapeng Yu <[email protected]>---
V2:
* Simplify the patch according to maintainer's comment:
only one "pmd_flow" in the list, so just "break;" is fine.--- drivers/net/ixgbe/ixgbe_flow.c | 1 + 1 file changed, 1 insertion(+)
Quoted 3 lines
Good catch, thanks!
Reviewed-by Haiyue Wang <[email protected]>
Applied to dpdk-next-net-intel.
Thanks
Qi
Quoted 4 lines
Quoted 4 lines
--
2.27.0