From: Mohammad Shuab Siddique <[email protected]>
STAILQ_FOREACH()'s own advance step dereferences the current node's
next field after the loop body runs. The loop body here frees that
same node (bnxt_free_filter()) before the macro dereferences it on
the next iteration, so the filter list walk in
bnxt_clear_hwrm_vnic_filters() reads freed memory to find the
following entry.
Walk the list with STAILQ_FIRST()/STAILQ_REMOVE_HEAD() instead,
removing each filter from the list before freeing it so nothing is
dereferenced after being freed.
Fixes: 20ef524432dd ("net/bnxt: set L2 filters")
Cc: [email protected]
Signed-off-by: Mohammad Shuab Siddique <[email protected]>
---
drivers/net/bnxt/bnxt_hwrm.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/net/bnxt/bnxt_hwrm.c b/drivers/net/bnxt/bnxt_hwrm.c
index 765aa7c452..99539d3705 100644
--- a/drivers/net/bnxt/bnxt_hwrm.c
+++ b/drivers/net/bnxt/bnxt_hwrm.c
@@ -3593,9 +3593,10 @@ bnxt_clear_hwrm_vnic_filters(struct bnxt *bp, struct
bnxt_vnic_info *vnic)
struct bnxt_filter_info *filter;
int rc = 0;
- STAILQ_FOREACH(filter, &vnic->filter, next) {
+ while (!STAILQ_EMPTY(&vnic->filter)) {
+ filter = STAILQ_FIRST(&vnic->filter);
rc = bnxt_clear_one_vnic_filter(bp, filter);
- STAILQ_REMOVE(&vnic->filter, filter, bnxt_filter_info, next);
+ STAILQ_REMOVE_HEAD(&vnic->filter, next);
bnxt_free_filter(bp, filter);
}
return rc;
--
2.47.3
