From patchwork Fri Jun 4 02:02:01 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Yu, DapengX" X-Patchwork-Id: 93860 X-Patchwork-Delegate: qi.z.zhang@intel.com Return-Path: X-Original-To: patchwork@inbox.dpdk.org Delivered-To: patchwork@inbox.dpdk.org Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 33509A0524; Fri, 4 Jun 2021 04:04:05 +0200 (CEST) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id A8A314068F; Fri, 4 Jun 2021 04:04:04 +0200 (CEST) Received: from mga12.intel.com (mga12.intel.com [192.55.52.136]) by mails.dpdk.org (Postfix) with ESMTP id 9D4F04003C; Fri, 4 Jun 2021 04:04:03 +0200 (CEST) IronPort-SDR: zK8rAuA8MeSVNyjtzHZYpCd+8usvsJCeH9fTaLkaD6QkX80SwZKV7WQHfOIvTrIhMPKM6xRaNh +IVd3+5KTgMg== X-IronPort-AV: E=McAfee;i="6200,9189,10004"; a="183886740" X-IronPort-AV: E=Sophos;i="5.83,246,1616482800"; d="scan'208";a="183886740" Received: from orsmga001.jf.intel.com ([10.7.209.18]) by fmsmga106.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 03 Jun 2021 19:02:15 -0700 IronPort-SDR: +ry2XXzd5xu+ENxtAZhh4aQbDp9YGoxBJKF9MzGB6WKcGkgOtKFDR8ygMLkpTqUk93oc9pU7CA PSGA+/7Z6dWA== X-IronPort-AV: E=Sophos;i="5.83,246,1616482800"; d="scan'208";a="480463140" Received: from unknown (HELO localhost.localdomain) ([10.240.183.93]) by orsmga001-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 03 Jun 2021 19:02:12 -0700 From: dapengx.yu@intel.com To: Beilei Xing Cc: dev@dpdk.org, Dapeng Yu , stable@dpdk.org Date: Fri, 4 Jun 2021 10:02:01 +0800 Message-Id: <20210604020201.2021442-1-dapengx.yu@intel.com> X-Mailer: git-send-email 2.27.0 MIME-Version: 1.0 Subject: [dpdk-dev] [PATCH] net/i40e: fix using heap pointer after free X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" From: Dapeng Yu The original code use a heap pointer after it is freed. Fixes: 460d1679586e ("drivers/net: delete HW rings while freeing queues") Cc: stable@dpdk.org Signed-off-by: Dapeng Yu Acked-by: Qi Zhang --- drivers/net/i40e/i40e_fdir.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/i40e/i40e_fdir.c b/drivers/net/i40e/i40e_fdir.c index ac0e09bfdd..3983122af7 100644 --- a/drivers/net/i40e/i40e_fdir.c +++ b/drivers/net/i40e/i40e_fdir.c @@ -301,11 +301,11 @@ i40e_fdir_teardown(struct i40e_pf *pf) if (err) PMD_DRV_LOG(DEBUG, "Failed to do FDIR RX switch off"); - i40e_dev_rx_queue_release(pf->fdir.rxq); rte_eth_dma_zone_free(dev, "fdir_rx_ring", pf->fdir.rxq->queue_id); + i40e_dev_rx_queue_release(pf->fdir.rxq); pf->fdir.rxq = NULL; - i40e_dev_tx_queue_release(pf->fdir.txq); rte_eth_dma_zone_free(dev, "fdir_tx_ring", pf->fdir.txq->queue_id); + i40e_dev_tx_queue_release(pf->fdir.txq); pf->fdir.txq = NULL; i40e_vsi_release(vsi); pf->fdir.fdir_vsi = NULL;