The list of segments to free was wrongly manipulated ending by only freeing
the first segment instead of freeing all of them.  The last one still
belongs to the NIC and thus should not be freed.

Fixes: a1bdb71a32da ("net/mlx5: fix crash in Rx")

CC: stable at dpdk.org
Reported-by: Liming Sun <lsun at mellanox.com>
Signed-off-by: Nelio Laranjeiro <nelio.laranjeiro at 6wind.com>
---
 drivers/net/mlx5/mlx5_rxtx.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/mlx5/mlx5_rxtx.c b/drivers/net/mlx5/mlx5_rxtx.c
index beff580..9bd4d80 100644
--- a/drivers/net/mlx5/mlx5_rxtx.c
+++ b/drivers/net/mlx5/mlx5_rxtx.c
@@ -1312,10 +1312,10 @@ mlx5_rx_burst(void *dpdk_rxq, struct rte_mbuf **pkts, 
uint16_t pkts_n)
                        }
                        while (pkt != seg) {
                                assert(pkt != (*rxq->elts)[idx]);
-                               seg = NEXT(pkt);
+                               rep = NEXT(pkt);
                                rte_mbuf_refcnt_set(pkt, 0);
                                __rte_mbuf_raw_free(pkt);
-                               pkt = seg;
+                               pkt = rep;
                        }
                        break;
                }
-- 
2.1.4

Reply via email to