net/mlx5: fix flow action destroy

ibv_destroy_flow_action() refers to QP. QP must not be freed until
corresponding action is destroyed.

Fixes: 3eb004431072 ("net/mlx5: fix release of jump to queue action")
Cc: stable@dpdk.org
Signed-off-by: Yongseok Koh <yskoh@mellanox.com>
Acked-by: Shahaf Shuler <shahafs@mellanox.com>

diff --git a/drivers/net/mlx5/mlx5_rxq.c b/drivers/net/mlx5/mlx5_rxq.c
index 9f27f60..0a4c02e 100644 (file)
--- a/drivers/net/mlx5/mlx5_rxq.c
+++ b/drivers/net/mlx5/mlx5_rxq.c
@@ -1946,11 +1946,11 @@ int
 mlx5_hrxq_release(struct rte_eth_dev *dev, struct mlx5_hrxq *hrxq)
 {
        if (rte_atomic32_dec_and_test(&hrxq->refcnt)) {
-               claim_zero(mlx5_glue->destroy_qp(hrxq->qp));
-               mlx5_ind_table_ibv_release(dev, hrxq->ind_table);
 #ifdef HAVE_IBV_FLOW_DV_SUPPORT
                mlx5_glue->destroy_flow_action(hrxq->action);
 #endif
+               claim_zero(mlx5_glue->destroy_qp(hrxq->qp));
+               mlx5_ind_table_ibv_release(dev, hrxq->ind_table);
                LIST_REMOVE(hrxq, next);
                rte_free(hrxq);
                return 0;
@@ -2217,11 +2217,11 @@ mlx5_hrxq_drop_release(struct rte_eth_dev *dev)
        struct mlx5_hrxq *hrxq = priv->drop_queue.hrxq;
 
        if (rte_atomic32_dec_and_test(&hrxq->refcnt)) {
-               claim_zero(mlx5_glue->destroy_qp(hrxq->qp));
-               mlx5_ind_table_ibv_drop_release(dev);
 #ifdef HAVE_IBV_FLOW_DV_SUPPORT
                mlx5_glue->destroy_flow_action(hrxq->action);
 #endif
+               claim_zero(mlx5_glue->destroy_qp(hrxq->qp));
+               mlx5_ind_table_ibv_drop_release(dev);
                rte_free(hrxq);
                priv->drop_queue.hrxq = NULL;
        }