net/txgbe: fix use-after-free in flow destroy

TAILQ_FOREACH advances via the current node's next pointer. Removing and freeing that node inside the loop reads freed memory on the next iteration.

Find the matching entry first, then remove it after the loop.

---
 drivers/net/txgbe/txgbe_flow.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

index 1bb0d3978c..eaeb973c91 100644
@@ -3667,11 +3667,13 @@ txgbe_flow_destroy(struct rte_eth_dev *dev,
 	}
 
 	TAILQ_FOREACH(txgbe_flow_mem_ptr, &txgbe_flow_list, entries) {
-		if (txgbe_flow_mem_ptr->flow == pmd_flow) {
-			TAILQ_REMOVE(&txgbe_flow_list,
-				txgbe_flow_mem_ptr, entries);
-			rte_free(txgbe_flow_mem_ptr);
-		}
+		if (txgbe_flow_mem_ptr->flow == pmd_flow)
+			break;
+	}
+	if (txgbe_flow_mem_ptr != NULL) {
+		TAILQ_REMOVE(&txgbe_flow_list,
+			txgbe_flow_mem_ptr, entries);
+		rte_free(txgbe_flow_mem_ptr);
 	}
 	rte_free(flow);
 

2.55.0

OK, another option would be to use TAILQ_FOREACH_SAFE which several other drivers do. I have a patch series to cleanup the queue macros but waiting.

Thanks for the review.

I kept the break-then-remove pattern because destroy looks up a single matching entry. TAILQ_FOREACH_SAFE is the right tool when the loop must continue after removing the current node (e.g. flush). Here the iteration should stop once the handle is found.

This file still uses <sys/queue.h>, and glibc has no TAILQ_FOREACH_SAFE. Switching to RTE_TAILQ_FOREACH_SAFE would mix the two until your queue macro cleanup lands.

Thanks,
Zhang Tengfei