git: 118ab70d5789 - stable/14 - tcp: fix list iteration in tcp_lro_flush_active()

From: Michael Tuexen <tuexen_at_FreeBSD.org>
Date: Fri, 30 Aug 2024 06:29:38 UTC
The branch stable/14 has been updated by tuexen:

URL: https://cgit.FreeBSD.org/src/commit/?id=118ab70d578934236251368c894973a4159ac514

commit 118ab70d578934236251368c894973a4159ac514
Author:     Michael Tuexen <tuexen@FreeBSD.org>
AuthorDate: 2024-08-20 22:07:37 +0000
Commit:     Michael Tuexen <tuexen@FreeBSD.org>
CommitDate: 2024-08-30 06:29:03 +0000

    tcp: fix list iteration in tcp_lro_flush_active()
    
    Use LIST_FOREACH_SAFE(), since the list element is removed from
    the list in the loop body, zero out and inserted in the free list.
    
    Reviewed by:            rrs
    Sponsored by:           Netflix, Inc.
    Differential Revision:  https://reviews.freebsd.org/D46383
    
    (cherry picked from commit 64443828bbe7c571db8d8731758ec8c4b8364c86)
---
 sys/netinet/tcp_lro.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sys/netinet/tcp_lro.c b/sys/netinet/tcp_lro.c
index 921d28f82517..2811cf25a052 100644
--- a/sys/netinet/tcp_lro.c
+++ b/sys/netinet/tcp_lro.c
@@ -599,7 +599,7 @@ tcp_lro_rx_done(struct lro_ctrl *lc)
 static void
 tcp_lro_flush_active(struct lro_ctrl *lc)
 {
-	struct lro_entry *le;
+	struct lro_entry *le, *le_tmp;
 
 	/*
 	 * Walk through the list of le entries, and
@@ -611,7 +611,7 @@ tcp_lro_flush_active(struct lro_ctrl *lc)
 	 * is being freed. This is ok it will just get
 	 * reallocated again like it was new.
 	 */
-	LIST_FOREACH(le, &lc->lro_active, next) {
+	LIST_FOREACH_SAFE(le, &lc->lro_active, next, le_tmp) {
 		if (le->m_head != NULL) {
 			tcp_lro_active_remove(le);
 			tcp_lro_flush(lc, le);