net/bnxt: fix interrupt handler

In some cases the interrupt handler is accessing cpr, which has
already been freed causing segfaults. This patch avoids such accesses.

Fixes: 7bc8e9a227cc ("net/bnxt: support async link notification")
Cc: stable@dpdk.org
Signed-off-by: Ajit Khaparde <ajit.khaparde@broadcom.com>

diff --git a/drivers/net/bnxt/bnxt_cpr.c b/drivers/net/bnxt/bnxt_cpr.c
index 68979bc..26b2755 100644 (file)
--- a/drivers/net/bnxt/bnxt_cpr.c
+++ b/drivers/net/bnxt/bnxt_cpr.c
@@ -183,8 +183,10 @@ void bnxt_free_def_cp_ring(struct bnxt *bp)
                return;
 
        bnxt_free_ring(cpr->cp_ring_struct);
+       cpr->cp_ring_struct = NULL;
        rte_free(cpr->cp_ring_struct);
        rte_free(cpr);
+       bp->def_cp_ring = NULL;
 }
 
 /* For the default completion ring only */

diff --git a/drivers/net/bnxt/bnxt_irq.c b/drivers/net/bnxt/bnxt_irq.c
index 47cda7e..79a1196 100644 (file)
--- a/drivers/net/bnxt/bnxt_irq.c
+++ b/drivers/net/bnxt/bnxt_irq.c
@@ -55,6 +55,9 @@ static void bnxt_int_handler(void *param)
        struct cmpl_base *cmp;
 
        while (1) {
+               if (!cpr || !cpr->cp_ring_struct)
+                       return;
+
                cons = RING_CMP(cpr->cp_ring_struct, raw_cons);
                cmp = &cpr->cp_desc_ring[cons];