net/mlx5: fix redundant free of Tx buffer

SW completion ring of Tx (txq->elts) stores individual mbufs even if a
multi-segmented packet is sent. rte_pktmbuf_free_seg() must be used when
cleaning up the completion ring. Otherwise, chained mbufs are redundantly
freed and finally it would cause a crash.

Fixes: 1d88ba171942 ("net/mlx5: refactor Tx data path")
CC: stable@dpdk.org
Signed-off-by: Yongseok Koh <yskoh@mellanox.com>
Acked-by: Nelio Laranjeiro <nelio.laranjeiro@6wind.com>

diff --git a/drivers/net/mlx5/mlx5_txq.c b/drivers/net/mlx5/mlx5_txq.c
index 6c1387e..bf72468 100644 (file)
--- a/drivers/net/mlx5/mlx5_txq.c
+++ b/drivers/net/mlx5/mlx5_txq.c
@@ -117,7 +117,7 @@ txq_free_elts(struct txq_ctrl *txq_ctrl)
                struct rte_mbuf *elt = (*elts)[elts_tail];
 
                assert(elt != NULL);
-               rte_pktmbuf_free(elt);
+               rte_pktmbuf_free_seg(elt);
 #ifndef NDEBUG
                /* Poisoning. */
                memset(&(*elts)[elts_tail],