[PATCH] net/txgbe: fix use-after-free in flow destroy

[Zhang Tengfei]

TAILQ_FOREACH advances via the current node's next pointer. Removing
and freeing that node inside the loop reads freed memory on the next
iteration.

Find the matching entry first, then remove it after the loop.

Fixes: e342da2d438f ("net/txgbe: support destroying consistent filter")
Cc: stable at dpdk.org

Signed-off-by: Zhang Tengfei <zhtfdev at gmail.com>
---
 drivers/net/txgbe/txgbe_flow.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/drivers/net/txgbe/txgbe_flow.c b/drivers/net/txgbe/txgbe_flow.c
index 1bb0d3978c..eaeb973c91 100644
--- a/drivers/net/txgbe/txgbe_flow.c
+++ b/drivers/net/txgbe/txgbe_flow.c
@@ -3667,11 +3667,13 @@ txgbe_flow_destroy(struct rte_eth_dev *dev,
 	}
 
 	TAILQ_FOREACH(txgbe_flow_mem_ptr, &txgbe_flow_list, entries) {
-		if (txgbe_flow_mem_ptr->flow == pmd_flow) {
-			TAILQ_REMOVE(&txgbe_flow_list,
-				txgbe_flow_mem_ptr, entries);
-			rte_free(txgbe_flow_mem_ptr);
-		}
+		if (txgbe_flow_mem_ptr->flow == pmd_flow)
+			break;
+	}
+	if (txgbe_flow_mem_ptr != NULL) {
+		TAILQ_REMOVE(&txgbe_flow_list,
+			txgbe_flow_mem_ptr, entries);
+		rte_free(txgbe_flow_mem_ptr);
 	}
 	rte_free(flow);
 
-- 
2.55.0