net/mlx5: fix tunnel flow destroy

Flow destructor tired to access flow related resources after the
flow object memory was already released and crashed dpdk process.

The patch moves flow memory release to the end of destructor.

Fixes: 4ec6360de37d ("net/mlx5: implement tunnel offload")
Signed-off-by: Gregory Etelson <getelson@nvidia.com>
Acked-by: Matan Azrad <matan@nvidia.com>

diff --git a/drivers/net/mlx5/mlx5_flow.c b/drivers/net/mlx5/mlx5_flow.c
index 28fd1992081e2f2d5c1dc482cf5fdbfe9e1965e3..f9420e71179a2e3f4cc4ae6b71ebd6b2c47e3edd 100644 (file)
--- a/drivers/net/mlx5/mlx5_flow.c
+++ b/drivers/net/mlx5/mlx5_flow.c
@@ -5888,8 +5888,6 @@ flow_list_destroy(struct rte_eth_dev *dev, uint32_t *list,
                             flow_idx, flow, next);
                rte_spinlock_unlock(&priv->flow_list_lock);
        }
-       flow_mreg_del_copy_action(dev, flow);
-       mlx5_ipool_free(priv->sh->ipool[MLX5_IPOOL_RTE_FLOW], flow_idx);
        if (flow->tunnel) {
                struct mlx5_flow_tunnel *tunnel;
 
@@ -5901,6 +5899,8 @@ flow_list_destroy(struct rte_eth_dev *dev, uint32_t *list,
                if (!__atomic_sub_fetch(&tunnel->refctn, 1, __ATOMIC_RELAXED))
                        mlx5_flow_tunnel_free(dev, tunnel);
        }
+       flow_mreg_del_copy_action(dev, flow);
+       mlx5_ipool_free(priv->sh->ipool[MLX5_IPOOL_RTE_FLOW], flow_idx);
 }
 
 /**