Re: [PATCH v2 3/5] net/bnxt: fix use-after-free in VNIC filter cleanup

[Stephen Hemminger <stephen@networkplumber.org>]

On Sun, 20 Sep 2026 20:20:00 -0600
Mohammad Shuab Siddique <mohammad-shuab.siddique@broadcom.com> wrote:

> From: Mohammad Shuab Siddique <mohammad-shuab.siddique@broadcom.com>
> 
> STAILQ_FOREACH()'s own advance step dereferences the current node's
> next field after the loop body runs. The loop body here frees that
> same node (bnxt_free_filter()) before the macro dereferences it on
> the next iteration, so the filter list walk in
> bnxt_clear_hwrm_vnic_filters() reads freed memory to find the
> following entry.
> 
> Walk the list with STAILQ_FIRST()/STAILQ_REMOVE_HEAD() instead,
> removing each filter from the list before freeing it so nothing is
> dereferenced after being freed.
> 
> Fixes: 20ef524432dd ("net/bnxt: set L2 filters")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Mohammad Shuab Siddique <mohammad-shuab.siddique@broadcom.com>
> ---

You could also use STAILQ_FOREACH_SAFE() instead.

AI flagged:

[PATCH v2 3/5] net/bnxt: fix use-after-free in VNIC filter cleanup

Warning: the commit message misdescribes the bug. bnxt_free_filter()
frees nothing; filters live in bp->filter_info[]. It memsets the
entry and inserts it on free_filter_list, leaving next == NULL. The
old STAILQ_FOREACH therefore stopped after the first filter. The
remaining filters were never cleared in HW and stayed on
vnic->filter. The code change is correct. Retitle, e.g. "fix VNIC
filter list walk", and describe the leaked filters.