On Thu, Nov 17, 2016 at 10:49:54AM +0100, Nelio Laranjeiro wrote:
> The list of segments to free was wrongly manipulated ending by only freeing
> the first segment instead of freeing all of them. The last one still
> belongs to the NIC and thus should not be freed.
>
> Fixes: a1bdb71a32da ("net/mlx5: fix crash in Rx")
>
> CC: stable at dpdk.org
> Reported-by: Liming Sun
> Signed-off-by: Nelio Laranjeiro
> ---
> drivers/net/mlx5/mlx5_rxtx.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/mlx5/mlx5_rxtx.c b/drivers/net/mlx5/mlx5_rxtx.c
> index beff580..9bd4d80 100644
> --- a/drivers/net/mlx5/mlx5_rxtx.c
> +++ b/drivers/net/mlx5/mlx5_rxtx.c
> @@ -1312,10 +1312,10 @@ mlx5_rx_burst(void *dpdk_rxq, struct rte_mbuf **pkts,
> uint16_t pkts_n)
> }
> while (pkt != seg) {
> assert(pkt != (*rxq->elts)[idx]);
> - seg = NEXT(pkt);
> + rep = NEXT(pkt);
> rte_mbuf_refcnt_set(pkt, 0);
> __rte_mbuf_raw_free(pkt);
> - pkt = seg;
> + pkt = rep;
> }
> break;
> }
> --
> 2.1.4
Acked-by: Adrien Mazarguil
--
Adrien Mazarguil
6WIND
