[PATCH v9 16/17] common/idpf: fix use after free due

[Stephen Hemminger]

The macro in this driver was redefining LIST_FOR_EACH_ENTRY_SAFE
as a simple LIST_FOR_EACH macro. But they are not the same
the _SAFE variant guarantees that there will not be use after free.

Fixes: fb4ac04e9bfa ("common/idpf: introduce common library")
Cc: junfeng.guo at intel.com
Signed-off-by: Stephen Hemminger <stephen at networkplumber.org>
---
 drivers/common/idpf/base/idpf_osdep.h    | 10 ++++++++--
 drivers/common/idpf/idpf_common_device.c |  3 +--
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/drivers/common/idpf/base/idpf_osdep.h b/drivers/common/idpf/base/idpf_osdep.h
index e042ef871c..cf9e553906 100644
--- a/drivers/common/idpf/base/idpf_osdep.h
+++ b/drivers/common/idpf/base/idpf_osdep.h
@@ -341,10 +341,16 @@ idpf_hweight32(u32 num)
 #define LIST_ENTRY_TYPE(type)	   LIST_ENTRY(type)
 #endif
 
+#ifndef LIST_FOREACH_SAFE
+#define LIST_FOREACH_SAFE(var, head, field, tvar)			\
+	for ((var) = LIST_FIRST((head));				\
+	    (var) && ((tvar) = LIST_NEXT((var), field), 1);		\
+	    (var) = (tvar))
+#endif
+
 #ifndef LIST_FOR_EACH_ENTRY_SAFE
 #define LIST_FOR_EACH_ENTRY_SAFE(pos, temp, head, entry_type, list)	\
-	LIST_FOREACH(pos, head, list)
-
+	LIST_FOREACH_SAFE(pos, head, list, temp)
 #endif
 
 #ifndef LIST_FOR_EACH_ENTRY
diff --git a/drivers/common/idpf/idpf_common_device.c b/drivers/common/idpf/idpf_common_device.c
index 8403ed83f9..e9fa024850 100644
--- a/drivers/common/idpf/idpf_common_device.c
+++ b/drivers/common/idpf/idpf_common_device.c
@@ -136,8 +136,7 @@ idpf_init_mbx(struct idpf_hw *hw)
 	if (ret != 0)
 		return ret;
 
-	LIST_FOR_EACH_ENTRY_SAFE(ctlq, NULL, &hw->cq_list_head,
-				 struct idpf_ctlq_info, cq_list) {
+	LIST_FOR_EACH_ENTRY(ctlq, &hw->cq_list_head, struct idpf_ctlq_info, cq_list) {
 		if (ctlq->q_id == IDPF_CTLQ_ID &&
 		    ctlq->cq_type == IDPF_CTLQ_TYPE_MAILBOX_TX)
 			hw->asq = ctlq;
-- 
2.45.2