From: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
Date: Fri, 28 Aug 2020 05:01:10 +0000 (+0530)
Subject: net/bnxt: fix crash in vector mode Tx
X-Git-Url: http://git.droids-corp.org/?a=commitdiff_plain;h=301cc1b4db590df8bbadbad9a0b2ea2ed125ba86;p=dpdk.git

net/bnxt: fix crash in vector mode Tx

rte_pktmbuf_prefree_seg() can return NULL if the mbuf still
has remaining references on it.

Adding a NULL check to prevent segfault.

Fixes: bc4a000f2f53 ("net/bnxt: implement SSE vector mode")
Fixes: 398358341419 ("net/bnxt: support NEON")
Cc: stable@dpdk.org

Signed-off-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
Reviewed-by: Lance Richardson <lance.richardson@broadcom.com>
Reviewed-by: Somnath Kotur <somnath.kotur@broadcom.com>
Reviewed-by: Ajit Khaparde <ajit.khaparde@broadcom.com>
---

diff --git a/drivers/net/bnxt/bnxt_rxtx_vec_neon.c b/drivers/net/bnxt/bnxt_rxtx_vec_neon.c
index 488a0b4667..bf76c2ac26 100644
--- a/drivers/net/bnxt/bnxt_rxtx_vec_neon.c
+++ b/drivers/net/bnxt/bnxt_rxtx_vec_neon.c
@@ -329,6 +329,8 @@ bnxt_tx_cmp_vec(struct bnxt_tx_queue *txq, int nr_pkts)
 		tx_buf = &txr->tx_buf_ring[cons];
 		cons = RING_NEXT(txr->tx_ring_struct, cons);
 		mbuf = rte_pktmbuf_prefree_seg(tx_buf->mbuf);
+		if (unlikely(mbuf == NULL))
+			continue;
 		tx_buf->mbuf = NULL;
 
 		if (blk && mbuf->pool != free[0]->pool) {
diff --git a/drivers/net/bnxt/bnxt_rxtx_vec_sse.c b/drivers/net/bnxt/bnxt_rxtx_vec_sse.c
index c4ca5cf2dd..98220bc1b3 100644
--- a/drivers/net/bnxt/bnxt_rxtx_vec_sse.c
+++ b/drivers/net/bnxt/bnxt_rxtx_vec_sse.c
@@ -334,6 +334,8 @@ bnxt_tx_cmp_vec(struct bnxt_tx_queue *txq, int nr_pkts)
 		tx_buf = &txr->tx_buf_ring[cons];
 		cons = RING_NEXT(txr->tx_ring_struct, cons);
 		mbuf = rte_pktmbuf_prefree_seg(tx_buf->mbuf);
+		if (unlikely(mbuf == NULL))
+			continue;
 		tx_buf->mbuf = NULL;
 
 		if (blk && mbuf->pool != free[0]->pool) {