diff mbox series

[v2] net/softnic: fix memory illegal access

Message ID 20180720110536.78526-1-jasvinder.singh@intel.com (mailing list archive)
State Accepted, archived
Delegated to: Ferruh Yigit
Headers
Series [v2] net/softnic: fix memory illegal access |

Checks

Context Check Description
ci/checkpatch success coding style OK
ci/Intel-compilation success Compilation OK

Commit Message

Jasvinder Singh July 20, 2018, 11:05 a.m. UTC 
  While deleting the elements from the linked list, TAILQ_FOREACH causes
read from the freed pointer. Fixes the issue by using TAILQ_FOREACH_SAFE
instead.

Coverity issue: 302867
Fixes: bef50bcb1c47 ("net/softnic: implement start and stop")

Signed-off-by: Jasvinder Singh <jasvinder.singh@intel.com>
Acked-by: Cristian Dumitrescu <cristian.dumitrescu@intel.com>
---
 drivers/net/softnic/rte_eth_softnic_swq.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

Comments

Ferruh Yigit July 20, 2018, 3:19 p.m. UTC | #1 
On 7/20/2018 12:05 PM, Jasvinder Singh wrote:
> While deleting the elements from the linked list, TAILQ_FOREACH causes
> read from the freed pointer. Fixes the issue by using TAILQ_FOREACH_SAFE
> instead.
> 
> Coverity issue: 302867
> Fixes: bef50bcb1c47 ("net/softnic: implement start and stop")
> 
> Signed-off-by: Jasvinder Singh <jasvinder.singh@intel.com>
> Acked-by: Cristian Dumitrescu <cristian.dumitrescu@intel.com>

Applied to dpdk-next-net/master, thanks.
diff mbox series

Patch

diff --git a/drivers/net/softnic/rte_eth_softnic_swq.c b/drivers/net/softnic/rte_eth_softnic_swq.c
index 1944fbb..2083d0a 100644
--- a/drivers/net/softnic/rte_eth_softnic_swq.c
+++ b/drivers/net/softnic/rte_eth_softnic_swq.c
@@ -6,6 +6,7 @@ 
 #include <string.h>
 
 #include <rte_string_fns.h>
+#include <rte_tailq.h>
 
 #include "rte_eth_softnic_internals.h"
 
@@ -36,9 +37,9 @@  softnic_swq_free(struct pmd_internals *p)
 void
 softnic_softnic_swq_free_keep_rxq_txq(struct pmd_internals *p)
 {
-	struct softnic_swq *swq;
+	struct softnic_swq *swq, *tswq;
 
-	TAILQ_FOREACH(swq, &p->swq_list, node) {
+	TAILQ_FOREACH_SAFE(swq, &p->swq_list, node, tswq) {
 		if ((strncmp(swq->name, "RXQ", strlen("RXQ")) == 0) ||
 			(strncmp(swq->name, "TXQ", strlen("TXQ")) == 0))
 			continue;