From 0b083fe41cac6bed70018e13bb33b0a072ea8fca Mon Sep 17 00:00:00 2001 From: Yongseok Koh Date: Tue, 23 Apr 2019 17:56:13 -0700 Subject: [PATCH] net/mlx5: fix flow action destroy ibv_destroy_flow_action() refers to QP. QP must not be freed until corresponding action is destroyed. Fixes: 3eb004431072 ("net/mlx5: fix release of jump to queue action") Cc: stable@dpdk.org Signed-off-by: Yongseok Koh Acked-by: Shahaf Shuler --- drivers/net/mlx5/mlx5_rxq.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/net/mlx5/mlx5_rxq.c b/drivers/net/mlx5/mlx5_rxq.c index 9f27f607b7..0a4c02e71e 100644 --- a/drivers/net/mlx5/mlx5_rxq.c +++ b/drivers/net/mlx5/mlx5_rxq.c @@ -1946,11 +1946,11 @@ int mlx5_hrxq_release(struct rte_eth_dev *dev, struct mlx5_hrxq *hrxq) { if (rte_atomic32_dec_and_test(&hrxq->refcnt)) { - claim_zero(mlx5_glue->destroy_qp(hrxq->qp)); - mlx5_ind_table_ibv_release(dev, hrxq->ind_table); #ifdef HAVE_IBV_FLOW_DV_SUPPORT mlx5_glue->destroy_flow_action(hrxq->action); #endif + claim_zero(mlx5_glue->destroy_qp(hrxq->qp)); + mlx5_ind_table_ibv_release(dev, hrxq->ind_table); LIST_REMOVE(hrxq, next); rte_free(hrxq); return 0; @@ -2217,11 +2217,11 @@ mlx5_hrxq_drop_release(struct rte_eth_dev *dev) struct mlx5_hrxq *hrxq = priv->drop_queue.hrxq; if (rte_atomic32_dec_and_test(&hrxq->refcnt)) { - claim_zero(mlx5_glue->destroy_qp(hrxq->qp)); - mlx5_ind_table_ibv_drop_release(dev); #ifdef HAVE_IBV_FLOW_DV_SUPPORT mlx5_glue->destroy_flow_action(hrxq->action); #endif + claim_zero(mlx5_glue->destroy_qp(hrxq->qp)); + mlx5_ind_table_ibv_drop_release(dev); rte_free(hrxq); priv->drop_queue.hrxq = NULL; } -- 2.20.1