net/mlx5: fix tunnel flow destroy

Flow destructor tired to access flow related resources after the
flow object memory was already released and crashed dpdk process.

The patch moves flow memory release to the end of destructor.

Fixes: 4ec6360de37d ("net/mlx5: implement tunnel offload")

Signed-off-by: Gregory Etelson <getelson@nvidia.com>
Acked-by: Matan Azrad <matan@nvidia.com>

diff --git a/drivers/net/mlx5/mlx5_flow.c b/drivers/net/mlx5/mlx5_flow.c
index 28fd199..f9420e7 100644 (file)
--- a/drivers/net/mlx5/mlx5_flow.c
+++ b/drivers/net/mlx5/mlx5_flow.c
@@ -5888,8 +5888,6 @@ flow_list_destroy(struct rte_eth_dev *dev, uint32_t *list,
                             flow_idx, flow, next);
                rte_spinlock_unlock(&priv->flow_list_lock);
        }
-       flow_mreg_del_copy_action(dev, flow);
-       mlx5_ipool_free(priv->sh->ipool[MLX5_IPOOL_RTE_FLOW], flow_idx);
        if (flow->tunnel) {
                struct mlx5_flow_tunnel *tunnel;
 
@@ -5901,6 +5899,8 @@ flow_list_destroy(struct rte_eth_dev *dev, uint32_t *list,
                if (!__atomic_sub_fetch(&tunnel->refctn, 1, __ATOMIC_RELAXED))
                        mlx5_flow_tunnel_free(dev, tunnel);
        }
+       flow_mreg_del_copy_action(dev, flow);
+       mlx5_ipool_free(priv->sh->ipool[MLX5_IPOOL_RTE_FLOW], flow_idx);
 }
 
 /**