i40e: fix using memory after free

The code uses "entry" in the next loop of LIST_FOREACH after calling free()
on it in i40e_res_pool_destroy().
Change to a safe way to free entry, which is similar with LIST_FOREACH_SAFE
in FreeBSD.

Fixes: 4861cde46116 ("i40e: new poll mode driver")

Signed-off-by: Jiangu Zhao <zhaojg@arraynetworks.com.cn>
Acked-by: Bruce Richardson <bruce.richardson@intel.com>

diff --git a/drivers/net/i40e/i40e_ethdev.c b/drivers/net/i40e/i40e_ethdev.c
index 91dcfd6..dbb909c 100644 (file)
--- a/drivers/net/i40e/i40e_ethdev.c
+++ b/drivers/net/i40e/i40e_ethdev.c
@@ -3349,17 +3349,21 @@ i40e_res_pool_init (struct i40e_res_pool_info *pool, uint32_t base,
 static void
 i40e_res_pool_destroy(struct i40e_res_pool_info *pool)
 {
-       struct pool_entry *entry;
+       struct pool_entry *entry, *next_entry;
 
        if (pool == NULL)
                return;
 
-       LIST_FOREACH(entry, &pool->alloc_list, next) {
+       for (entry = LIST_FIRST(&pool->alloc_list);
+                       entry && (next_entry = LIST_NEXT(entry, next), 1);
+                       entry = next_entry) {
                LIST_REMOVE(entry, next);
                rte_free(entry);
        }
 
-       LIST_FOREACH(entry, &pool->free_list, next) {
+       for (entry = LIST_FIRST(&pool->free_list);
+                       entry && (next_entry = LIST_NEXT(entry, next), 1);
+                       entry = next_entry) {
                LIST_REMOVE(entry, next);
                rte_free(entry);
        }