From: Adrien Mazarguil <adrien.mazarguil@6wind.com>
Date: Tue, 30 Jun 2015 09:27:47 +0000 (+0200)
Subject: mlx4: fix possible crash on scattered mbuf allocation failure
X-Git-Tag: spdx-start~8906
X-Git-Url: http://git.droids-corp.org/?a=commitdiff_plain;h=53bbf5afbdaab6242d400e8b725ac6c6e9c50e10;p=dpdk.git

mlx4: fix possible crash on scattered mbuf allocation failure

When failing to allocate a segment, mlx4_rx_burst_sp() may call
rte_pktmbuf_free() on an incomplete scattered mbuf whose next pointer
in the last segment is not set.

Signed-off-by: Adrien Mazarguil <adrien.mazarguil@6wind.com>
---

diff --git a/drivers/net/mlx4/mlx4.c b/drivers/net/mlx4/mlx4.c
index 5391b7afdc..d1166b24d8 100644
--- a/drivers/net/mlx4/mlx4.c
+++ b/drivers/net/mlx4/mlx4.c
@@ -2370,8 +2370,10 @@ mlx4_rx_burst_sp(void *dpdk_rxq, struct rte_mbuf **pkts, uint16_t pkts_n)
 				DEBUG("rxq=%p, wr_id=%" PRIu64 ":"
 				      " can't allocate a new mbuf",
 				      (void *)rxq, wr_id);
-				if (pkt_buf != NULL)
+				if (pkt_buf != NULL) {
+					*pkt_buf_next = NULL;
 					rte_pktmbuf_free(pkt_buf);
+				}
 				/* Increase out of memory counters. */
 				++rxq->stats.rx_nombuf;
 				++rxq->priv->dev->data->rx_mbuf_alloc_failed;