From: Jiangu Zhao <zhaojg@arraynetworks.com.cn>
Date: Fri, 25 Mar 2016 09:17:01 +0000 (+0000)
Subject: i40e: fix using memory after free
X-Git-Tag: spdx-start~7163
X-Git-Url: http://git.droids-corp.org/?a=commitdiff_plain;h=b3fa893d84d650f82cc7250d895c84dff0c7ce5b;p=dpdk.git

i40e: fix using memory after free

The code uses "entry" in the next loop of LIST_FOREACH after calling free()
on it in i40e_res_pool_destroy().
Change to a safe way to free entry, which is similar with LIST_FOREACH_SAFE
in FreeBSD.

Fixes: 4861cde46116 ("i40e: new poll mode driver")

Signed-off-by: Jiangu Zhao <zhaojg@arraynetworks.com.cn>
Acked-by: Bruce Richardson <bruce.richardson@intel.com>
---

diff --git a/drivers/net/i40e/i40e_ethdev.c b/drivers/net/i40e/i40e_ethdev.c
index 91dcfd6f45..dbb909c6b9 100644
--- a/drivers/net/i40e/i40e_ethdev.c
+++ b/drivers/net/i40e/i40e_ethdev.c
@@ -3349,17 +3349,21 @@ i40e_res_pool_init (struct i40e_res_pool_info *pool, uint32_t base,
 static void
 i40e_res_pool_destroy(struct i40e_res_pool_info *pool)
 {
-	struct pool_entry *entry;
+	struct pool_entry *entry, *next_entry;
 
 	if (pool == NULL)
 		return;
 
-	LIST_FOREACH(entry, &pool->alloc_list, next) {
+	for (entry = LIST_FIRST(&pool->alloc_list);
+			entry && (next_entry = LIST_NEXT(entry, next), 1);
+			entry = next_entry) {
 		LIST_REMOVE(entry, next);
 		rte_free(entry);
 	}
 
-	LIST_FOREACH(entry, &pool->free_list, next) {
+	for (entry = LIST_FIRST(&pool->free_list);
+			entry && (next_entry = LIST_NEXT(entry, next), 1);
+			entry = next_entry) {
 		LIST_REMOVE(entry, next);
 		rte_free(entry);
 	}