From b3fa893d84d650f82cc7250d895c84dff0c7ce5b Mon Sep 17 00:00:00 2001 From: Jiangu Zhao Date: Fri, 25 Mar 2016 09:17:01 +0000 Subject: [PATCH] i40e: fix using memory after free The code uses "entry" in the next loop of LIST_FOREACH after calling free() on it in i40e_res_pool_destroy(). Change to a safe way to free entry, which is similar with LIST_FOREACH_SAFE in FreeBSD. Fixes: 4861cde46116 ("i40e: new poll mode driver") Signed-off-by: Jiangu Zhao Acked-by: Bruce Richardson --- drivers/net/i40e/i40e_ethdev.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/drivers/net/i40e/i40e_ethdev.c b/drivers/net/i40e/i40e_ethdev.c index 91dcfd6f45..dbb909c6b9 100644 --- a/drivers/net/i40e/i40e_ethdev.c +++ b/drivers/net/i40e/i40e_ethdev.c @@ -3349,17 +3349,21 @@ i40e_res_pool_init (struct i40e_res_pool_info *pool, uint32_t base, static void i40e_res_pool_destroy(struct i40e_res_pool_info *pool) { - struct pool_entry *entry; + struct pool_entry *entry, *next_entry; if (pool == NULL) return; - LIST_FOREACH(entry, &pool->alloc_list, next) { + for (entry = LIST_FIRST(&pool->alloc_list); + entry && (next_entry = LIST_NEXT(entry, next), 1); + entry = next_entry) { LIST_REMOVE(entry, next); rte_free(entry); } - LIST_FOREACH(entry, &pool->free_list, next) { + for (entry = LIST_FIRST(&pool->free_list); + entry && (next_entry = LIST_NEXT(entry, next), 1); + entry = next_entry) { LIST_REMOVE(entry, next); rte_free(entry); } -- 2.20.1