The table remove callback function is trying to destroy the
matchers list associated with table entries without checking
if the list is valid, which causes nullptr dereference.
Fixed by validating the matchers list before destroying it.

Issue can be reproduced with testpmd on Windows, when you run:
port close all

Fixes: 1872635570be ("net/mlx5: make matcher list thread safe")
Cc: sta...@dpdk.org

Signed-off-by: Adham Masarwah <ad...@nvidia.com>
Acked-by: Viacheslav Ovsiienko <viachesl...@nvidia.com>
---
 drivers/net/mlx5/mlx5_flow_dv.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/mlx5/mlx5_flow_dv.c b/drivers/net/mlx5/mlx5_flow_dv.c
index ef9c66eddf..baef252a7a 100644
--- a/drivers/net/mlx5/mlx5_flow_dv.c
+++ b/drivers/net/mlx5/mlx5_flow_dv.c
@@ -10503,7 +10503,8 @@ flow_dv_tbl_remove_cb(void *tool_ctx, struct 
mlx5_list_entry *entry)
                        tbl_data->tunnel->tunnel_id : 0,
                        tbl_data->group_id);
        }
-       mlx5_list_destroy(tbl_data->matchers);
+       if (tbl_data->matchers)
+               mlx5_list_destroy(tbl_data->matchers);
        mlx5_ipool_free(sh->ipool[MLX5_IPOOL_JUMP], tbl_data->idx);
 }
 
-- 
2.16.1.windows.4

Reply via email to