From: Long Li <longli@microsoft.com>
Date: Tue, 11 Aug 2020 02:33:13 +0000 (-0700)
Subject: net/netvsc: fix stale value after free
X-Git-Url: http://git.droids-corp.org/?a=commitdiff_plain;h=0caf5621a4cdaadb40c7686d86bf58dd841057d3;p=dpdk.git

net/netvsc: fix stale value after free

chim_index could potentially be used in other hn_txdesc when re-allocated.
Mark it as invalid to prevent stale value being used.

Fixes: cc0251813277 ("net/netvsc: split send buffers from Tx descriptors")
Cc: stable@dpdk.org

Signed-off-by: Long Li <longli@microsoft.com>
Acked-by: Stephen Hemminger <stephen@networkplumber.org>
---

diff --git a/drivers/net/netvsc/hn_rxtx.c b/drivers/net/netvsc/hn_rxtx.c
index c8c4ee10c8..a388ff2588 100644
--- a/drivers/net/netvsc/hn_rxtx.c
+++ b/drivers/net/netvsc/hn_rxtx.c
@@ -419,8 +419,10 @@ hn_nvs_send_completed(struct rte_eth_dev *dev, uint16_t queue_id,
 		++txq->stats.errors;
 	}
 
-	if (txd->chim_index != NVS_CHIM_IDX_INVALID)
+	if (txd->chim_index != NVS_CHIM_IDX_INVALID) {
 		hn_chim_free(hv, txd->chim_index);
+		txd->chim_index = NVS_CHIM_IDX_INVALID;
+	}
 
 	rte_pktmbuf_free(txd->m);
 	hn_txd_put(txq, txd);