From 4b5b8ce8ffe57c611ccee438dea67b612021cfba Mon Sep 17 00:00:00 2001 From: Dapeng Yu Date: Fri, 4 Jun 2021 10:02:01 +0800 Subject: [PATCH] net/i40e: fix use after free in FDIR release The original code use a heap pointer after it is freed. Fixes: 460d1679586e ("drivers/net: delete HW rings while freeing queues") Cc: stable@dpdk.org Signed-off-by: Dapeng Yu Acked-by: Qi Zhang --- drivers/net/i40e/i40e_fdir.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/i40e/i40e_fdir.c b/drivers/net/i40e/i40e_fdir.c index 3c7cf1ba90..20658816ee 100644 --- a/drivers/net/i40e/i40e_fdir.c +++ b/drivers/net/i40e/i40e_fdir.c @@ -301,11 +301,11 @@ i40e_fdir_teardown(struct i40e_pf *pf) if (err) PMD_DRV_LOG(DEBUG, "Failed to do FDIR RX switch off"); - i40e_dev_rx_queue_release(pf->fdir.rxq); rte_eth_dma_zone_free(dev, "fdir_rx_ring", pf->fdir.rxq->queue_id); + i40e_dev_rx_queue_release(pf->fdir.rxq); pf->fdir.rxq = NULL; - i40e_dev_tx_queue_release(pf->fdir.txq); rte_eth_dma_zone_free(dev, "fdir_tx_ring", pf->fdir.txq->queue_id); + i40e_dev_tx_queue_release(pf->fdir.txq); pf->fdir.txq = NULL; i40e_vsi_release(vsi); pf->fdir.fdir_vsi = NULL; -- 2.20.1