The branch main has been updated by tuexen:
URL:
https://cgit.FreeBSD.org/src/commit/?id=64443828bbe7c571db8d8731758ec8c4b8364c86
commit 64443828bbe7c571db8d8731758ec8c4b8364c86
Author: Michael Tuexen <tue...@freebsd.org>
AuthorDate: 2024-08-20 22:07:37 +0000
Commit: Michael Tuexen <tue...@freebsd.org>
CommitDate: 2024-08-20 22:07:37 +0000
tcp: fix list iteration in tcp_lro_flush_active()
Use LIST_FOREACH_SAFE(), since the list element is removed from
the list in the loop body, zero out and inserted in the free list.
Reviewed by: rrs
MFC after: 1 week
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D46383
---
sys/netinet/tcp_lro.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/sys/netinet/tcp_lro.c b/sys/netinet/tcp_lro.c
index 2603815f9e61..906e01257a04 100644
--- a/sys/netinet/tcp_lro.c
+++ b/sys/netinet/tcp_lro.c
@@ -595,7 +595,7 @@ tcp_lro_rx_done(struct lro_ctrl *lc)
static void
tcp_lro_flush_active(struct lro_ctrl *lc)
{
- struct lro_entry *le;
+ struct lro_entry *le, *le_tmp;
/*
* Walk through the list of le entries, and
@@ -607,7 +607,7 @@ tcp_lro_flush_active(struct lro_ctrl *lc)
* is being freed. This is ok it will just get
* reallocated again like it was new.
*/
- LIST_FOREACH(le, &lc->lro_active, next) {
+ LIST_FOREACH_SAFE(le, &lc->lro_active, next, le_tmp) {
if (le->m_head != NULL) {
tcp_lro_active_remove(le);
tcp_lro_flush(lc, le);
