[dpdk-dev,v2] i40e: fix using memory after free issue
Commit Message
The old code still uses entry in the next loop of LIST_FOREACH after free() in i40e_res_pool_destroy().
Change to a safe way to free entry, which is similar with LIST_FOREACH_SAFE in FreeBSD.
Fixes: 4861cde46116 ("i40e: new poll mode driver")
Signed-off-by: Jiangu Zhao <zhaojg@arraynetworks.com.cn>
---
drivers/net/i40e/i40e_ethdev.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
Comments
On Fri, Mar 25, 2016 at 09:17:01AM +0000, Jiangu Zhao wrote:
> The old code still uses entry in the next loop of LIST_FOREACH after free() in i40e_res_pool_destroy().
> Change to a safe way to free entry, which is similar with LIST_FOREACH_SAFE in FreeBSD.
>
> Fixes: 4861cde46116 ("i40e: new poll mode driver")
>
> Signed-off-by: Jiangu Zhao <zhaojg@arraynetworks.com.cn>
Acked-by: Bruce Richardson <bruce.richardson@intel.com>
Applied to dpdk-next-net/rel_16_04
/Bruce
@@ -3335,17 +3335,21 @@ i40e_res_pool_init (struct i40e_res_pool_info *pool, uint32_t base,
static void
i40e_res_pool_destroy(struct i40e_res_pool_info *pool)
{
- struct pool_entry *entry;
+ struct pool_entry *entry, *next_entry;
if (pool == NULL)
return;
- LIST_FOREACH(entry, &pool->alloc_list, next) {
+ for (entry = LIST_FIRST(&pool->alloc_list);
+ entry && (next_entry = LIST_NEXT(entry, next), 1);
+ entry = next_entry) {
LIST_REMOVE(entry, next);
rte_free(entry);
}
- LIST_FOREACH(entry, &pool->free_list, next) {
+ for (entry = LIST_FIRST(&pool->free_list);
+ entry && (next_entry = LIST_NEXT(entry, next), 1);
+ entry = next_entry) {
LIST_REMOVE(entry, next);
rte_free(entry);
}