net/netvsc: fix stale value after free

chim_index could potentially be used in other hn_txdesc when re-allocated.
Mark it as invalid to prevent stale value being used.

Fixes: cc0251813277 ("net/netvsc: split send buffers from Tx descriptors")
Cc: stable@dpdk.org
Signed-off-by: Long Li <longli@microsoft.com>
Acked-by: Stephen Hemminger <stephen@networkplumber.org>

diff --git a/drivers/net/netvsc/hn_rxtx.c b/drivers/net/netvsc/hn_rxtx.c
index c8c4ee1..a388ff2 100644 (file)
--- a/drivers/net/netvsc/hn_rxtx.c
+++ b/drivers/net/netvsc/hn_rxtx.c
@@ -419,8 +419,10 @@ hn_nvs_send_completed(struct rte_eth_dev *dev, uint16_t queue_id,
                ++txq->stats.errors;
        }
 
-       if (txd->chim_index != NVS_CHIM_IDX_INVALID)
+       if (txd->chim_index != NVS_CHIM_IDX_INVALID) {
                hn_chim_free(hv, txd->chim_index);
+               txd->chim_index = NVS_CHIM_IDX_INVALID;
+       }
 
        rte_pktmbuf_free(txd->m);
        hn_txd_put(txq, txd);