[PATCH] net/txgbe: fix use-after-free in flow destroy

[dev zhang]

Thanks for the review.

I kept the break-then-remove pattern because destroy looks up a
single matching entry. TAILQ_FOREACH_SAFE is the right tool when the
loop must continue after removing the current node (e.g. flush).
Here the iteration should stop once the handle is found.

This file still uses <sys/queue.h>, and glibc has no
TAILQ_FOREACH_SAFE. Switching to RTE_TAILQ_FOREACH_SAFE would mix
the two until your queue macro cleanup lands.

Thanks,
Zhang Tengfei

Stephen Hemminger <stephen at networkplumber.org> 于2026年9月10日周四 23:53写道：

> On Thu, 10 Sep 2026 21:39:41 +0800
> Zhang Tengfei <zhtfdev at gmail.com> wrote:
>
> > TAILQ_FOREACH advances via the current node's next pointer. Removing
> > and freeing that node inside the loop reads freed memory on the next
> > iteration.
> >
> > Find the matching entry first, then remove it after the loop.
> >
> > Fixes: e342da2d438f ("net/txgbe: support destroying consistent filter")
> > Cc: stable at dpdk.org
> >
>
> OK, another option would be to use TAILQ_FOREACH_SAFE which several other
> drivers do. I have a patch series to cleanup the queue macros but waiting.
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mails.dpdk.org/archives/stable/attachments/20260911/2dcd7799/attachment.htm>