[PATCH] net/txgbe: fix use-after-free in flow destroy

[PATCH] net/txgbe: fix use-after-free in flow destroy

[Zhang Tengfei]

TAILQ_FOREACH advances via the current node's next pointer. Removing
and freeing that node inside the loop reads freed memory on the next
iteration.

Find the matching entry first, then remove it after the loop.

Fixes: e342da2d438f ("net/txgbe: support destroying consistent filter")
Cc: stable@dpdk.org

Signed-off-by: Zhang Tengfei <zhtfdev@gmail.com>
---
 drivers/net/txgbe/txgbe_flow.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/drivers/net/txgbe/txgbe_flow.c b/drivers/net/txgbe/txgbe_flow.c
index 1bb0d3978c..eaeb973c91 100644
--- a/drivers/net/txgbe/txgbe_flow.c
+++ b/drivers/net/txgbe/txgbe_flow.c
@@ -3667,11 +3667,13 @@ txgbe_flow_destroy(struct rte_eth_dev *dev,
 	}
 
 	TAILQ_FOREACH(txgbe_flow_mem_ptr, &txgbe_flow_list, entries) {
-		if (txgbe_flow_mem_ptr->flow == pmd_flow) {
-			TAILQ_REMOVE(&txgbe_flow_list,
-				txgbe_flow_mem_ptr, entries);
-			rte_free(txgbe_flow_mem_ptr);
-		}
+		if (txgbe_flow_mem_ptr->flow == pmd_flow)
+			break;
+	}
+	if (txgbe_flow_mem_ptr != NULL) {
+		TAILQ_REMOVE(&txgbe_flow_list,
+			txgbe_flow_mem_ptr, entries);
+		rte_free(txgbe_flow_mem_ptr);
 	}
 	rte_free(flow);
 
-- 
2.55.0

Re: [PATCH] net/txgbe: fix use-after-free in flow destroy

[Stephen Hemminger]

On Thu, 10 Sep 2026 21:39:41 +0800
Zhang Tengfei <zhtfdev@gmail.com> wrote:

> TAILQ_FOREACH advances via the current node's next pointer. Removing
> and freeing that node inside the loop reads freed memory on the next
> iteration.
> 
> Find the matching entry first, then remove it after the loop.
> 
> Fixes: e342da2d438f ("net/txgbe: support destroying consistent filter")
> Cc: stable@dpdk.org
> 

OK, another option would be to use TAILQ_FOREACH_SAFE which several other
drivers do. I have a patch series to cleanup the queue macros but waiting.

Re: [PATCH] net/txgbe: fix use-after-free in flow destroy

[dev zhang]

[-- Attachment #1: Type: text/plain, Size: 1168 bytes --]

Thanks for the review.

I kept the break-then-remove pattern because destroy looks up a
single matching entry. TAILQ_FOREACH_SAFE is the right tool when the
loop must continue after removing the current node (e.g. flush).
Here the iteration should stop once the handle is found.

This file still uses <sys/queue.h>, and glibc has no
TAILQ_FOREACH_SAFE. Switching to RTE_TAILQ_FOREACH_SAFE would mix
the two until your queue macro cleanup lands.

Thanks,
Zhang Tengfei

Stephen Hemminger <stephen@networkplumber.org> 于2026年9月10日周四 23:53写道：

> On Thu, 10 Sep 2026 21:39:41 +0800
> Zhang Tengfei <zhtfdev@gmail.com> wrote:
>
> > TAILQ_FOREACH advances via the current node's next pointer. Removing
> > and freeing that node inside the loop reads freed memory on the next
> > iteration.
> >
> > Find the matching entry first, then remove it after the loop.
> >
> > Fixes: e342da2d438f ("net/txgbe: support destroying consistent filter")
> > Cc: stable@dpdk.org
> >
>
> OK, another option would be to use TAILQ_FOREACH_SAFE which several other
> drivers do. I have a patch series to cleanup the queue macros but waiting.
>

[-- Attachment #2: Type: text/html, Size: 1689 bytes --]