From mboxrd@z Thu Jan 1 00:00:00 1970 From: Bruce Richardson Subject: Re: [PATCH] i40e: fix using memory after free issue Date: Tue, 22 Mar 2016 15:37:45 +0000 Message-ID: <20160322153744.GA20448@bricha3-MOBL3> References: <1457946124-17767-1-git-send-email-zhaojg@arraynetworks.com.cn> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: helin.zhang@intel.com, dev@dpdk.org To: Jiangu Zhao Return-path: Received: from mga04.intel.com (mga04.intel.com [192.55.52.120]) by dpdk.org (Postfix) with ESMTP id D94812BE4 for ; Tue, 22 Mar 2016 16:37:49 +0100 (CET) Content-Disposition: inline In-Reply-To: <1457946124-17767-1-git-send-email-zhaojg@arraynetworks.com.cn> List-Id: patches and discussions about DPDK List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" On Mon, Mar 14, 2016 at 09:02:04AM +0000, Jiangu Zhao wrote: > The old code still uses entry in the next loop of LIST_FOREACH after free() in i40e_res_pool_destroy(). > Change to a safe way to free entry, which is similar with LIST_FOREACH_SAFE in FreeBSD. > > Signed-off-by: Jiangu Zhao Thanks for the patch. It's missing a "fixes" line as descripted here: http://dpdk.org/doc/guides/contributing/patches.html#commit-messages-body so can you perhaps reply with the id of the commit this is fixing, (or add it into the commit message if you end up doing a V2 of the patch) Helin, can you perhaps review this patch as i40e maintainer. > --- > drivers/net/i40e/i40e_ethdev.c | 10 +++++++--- > 1 file changed, 7 insertions(+), 3 deletions(-) > > diff --git a/drivers/net/i40e/i40e_ethdev.c b/drivers/net/i40e/i40e_ethdev.c > index 2f676f6..5af2128 100644 > --- a/drivers/net/i40e/i40e_ethdev.c > +++ b/drivers/net/i40e/i40e_ethdev.c > @@ -3317,17 +3317,21 @@ i40e_res_pool_init (struct i40e_res_pool_info *pool, uint32_t base, > static void > i40e_res_pool_destroy(struct i40e_res_pool_info *pool) > { > - struct pool_entry *entry; > + struct pool_entry *entry, *next_entry; > > if (pool == NULL) > return; > > - LIST_FOREACH(entry, &pool->alloc_list, next) { > + for (entry = LIST_FIRST(&pool->alloc_list); > + entry && (next_entry = LIST_NEXT(entry, next), 1); > + entry = next_entry) { Can we use LIST_FOREACH_SAFE? /Bruce