[dpdk-dev] [PATCH] i40e: fix using memory after free issue

[Jiangu Zhao]

The old code still uses entry in the next loop of LIST_FOREACH after free() in 
i40e_res_pool_destroy().
Change to a safe way to free entry, which is similar with LIST_FOREACH_SAFE in 
FreeBSD.

Signed-off-by: Jiangu Zhao 
---
 drivers/net/i40e/i40e_ethdev.c | 10 +++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/net/i40e/i40e_ethdev.c b/drivers/net/i40e/i40e_ethdev.c
index 2f676f6..5af2128 100644
--- a/drivers/net/i40e/i40e_ethdev.c
+++ b/drivers/net/i40e/i40e_ethdev.c
@@ -3317,17 +3317,21 @@ i40e_res_pool_init (struct i40e_res_pool_info *pool, 
uint32_t base,
 static void
 i40e_res_pool_destroy(struct i40e_res_pool_info *pool)
 {
-   struct pool_entry *entry;
+   struct pool_entry *entry, *next_entry;

if (pool == NULL)
return;

-   LIST_FOREACH(entry, &pool->alloc_list, next) {
+   for (entry = LIST_FIRST(&pool->alloc_list); 
+   entry && (next_entry = LIST_NEXT(entry, next), 1);
+   entry = next_entry) {
LIST_REMOVE(entry, next);
rte_free(entry);
}

-   LIST_FOREACH(entry, &pool->free_list, next) {
+   for (entry = LIST_FIRST(&pool->free_list); 
+   entry && (next_entry = LIST_NEXT(entry, next), 1); 
+   entry = next_entry) {
LIST_REMOVE(entry, next);
rte_free(entry);
}
-- 
1.8.3.1

[dpdk-dev] [PATCH v2] i40e: fix using memory after free issue

[Jiangu Zhao]

The old code still uses entry in the next loop of LIST_FOREACH after free() in 
i40e_res_pool_destroy().
Change to a safe way to free entry, which is similar with LIST_FOREACH_SAFE in 
FreeBSD.

Fixes: 4861cde46116 ("i40e: new poll mode driver")

Signed-off-by: Jiangu Zhao 
---
 drivers/net/i40e/i40e_ethdev.c | 10 +++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/net/i40e/i40e_ethdev.c b/drivers/net/i40e/i40e_ethdev.c
index 6fdae57..42f5c82 100644
--- a/drivers/net/i40e/i40e_ethdev.c
+++ b/drivers/net/i40e/i40e_ethdev.c
@@ -3335,17 +3335,21 @@ i40e_res_pool_init (struct i40e_res_pool_info *pool, 
uint32_t base,
 static void
 i40e_res_pool_destroy(struct i40e_res_pool_info *pool)
 {
-   struct pool_entry *entry;
+   struct pool_entry *entry, *next_entry;

if (pool == NULL)
return;

-   LIST_FOREACH(entry, &pool->alloc_list, next) {
+   for (entry = LIST_FIRST(&pool->alloc_list); 
+   entry && (next_entry = LIST_NEXT(entry, next), 1);
+   entry = next_entry) {
LIST_REMOVE(entry, next);
rte_free(entry);
}

-   LIST_FOREACH(entry, &pool->free_list, next) {
+   for (entry = LIST_FIRST(&pool->free_list); 
+   entry && (next_entry = LIST_NEXT(entry, next), 1); 
+   entry = next_entry) {
LIST_REMOVE(entry, next);
rte_free(entry);
}
-- 
1.8.3.1