On Sun, 20 Sep 2026 20:20:00 -0600 Mohammad Shuab Siddique <[email protected]> wrote:
> From: Mohammad Shuab Siddique <[email protected]> > > STAILQ_FOREACH()'s own advance step dereferences the current node's > next field after the loop body runs. The loop body here frees that > same node (bnxt_free_filter()) before the macro dereferences it on > the next iteration, so the filter list walk in > bnxt_clear_hwrm_vnic_filters() reads freed memory to find the > following entry. > > Walk the list with STAILQ_FIRST()/STAILQ_REMOVE_HEAD() instead, > removing each filter from the list before freeing it so nothing is > dereferenced after being freed. > > Fixes: 20ef524432dd ("net/bnxt: set L2 filters") > Cc: [email protected] > > Signed-off-by: Mohammad Shuab Siddique <[email protected]> > --- You could also use STAILQ_FOREACH_SAFE() instead. AI flagged: [PATCH v2 3/5] net/bnxt: fix use-after-free in VNIC filter cleanup Warning: the commit message misdescribes the bug. bnxt_free_filter() frees nothing; filters live in bp->filter_info[]. It memsets the entry and inserts it on free_filter_list, leaving next == NULL. The old STAILQ_FOREACH therefore stopped after the first filter. The remaining filters were never cleared in HW and stayed on vnic->filter. The code change is correct. Retitle, e.g. "fix VNIC filter list walk", and describe the leaked filters.
