ip_frag: fix double free of chained mbufs

[dpdk.git] / lib / librte_ip_frag / rte_ipv6_reassembly.c

diff --git a/lib/librte_ip_frag/rte_ipv6_reassembly.c b/lib/librte_ip_frag/rte_ipv6_reassembly.c
index 3479fabb8fa7cf31f55ba8b30c96e5b32566c7ab..db249fe600f9cafe8d8fb368461e374ceb5fb5fb 100644 (file)
--- a/lib/librte_ip_frag/rte_ipv6_reassembly.c
+++ b/lib/librte_ip_frag/rte_ipv6_reassembly.c
@@ -82,7 +82,9 @@ ipv6_frag_reassemble(struct ip_frag_pkt *fp)
        /* chain with the first fragment. */
        rte_pktmbuf_adj(m, (uint16_t)(m->l2_len + m->l3_len));
        rte_pktmbuf_chain(fp->frags[IP_FIRST_FRAG_IDX].mb, m);
+       fp->frags[curr_idx].mb = NULL;
        m = fp->frags[IP_FIRST_FRAG_IDX].mb;
+       fp->frags[IP_FIRST_FRAG_IDX].mb = NULL;
 
        /* update mbuf fields for reassembled packet. */
        m->ol_flags |= PKT_TX_IP_CKSUM;