From 53bbf5afbdaab6242d400e8b725ac6c6e9c50e10 Mon Sep 17 00:00:00 2001 From: Adrien Mazarguil Date: Tue, 30 Jun 2015 11:27:47 +0200 Subject: [PATCH] mlx4: fix possible crash on scattered mbuf allocation failure When failing to allocate a segment, mlx4_rx_burst_sp() may call rte_pktmbuf_free() on an incomplete scattered mbuf whose next pointer in the last segment is not set. Signed-off-by: Adrien Mazarguil --- drivers/net/mlx4/mlx4.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/mlx4/mlx4.c b/drivers/net/mlx4/mlx4.c index 5391b7afdc..d1166b24d8 100644 --- a/drivers/net/mlx4/mlx4.c +++ b/drivers/net/mlx4/mlx4.c @@ -2370,8 +2370,10 @@ mlx4_rx_burst_sp(void *dpdk_rxq, struct rte_mbuf **pkts, uint16_t pkts_n) DEBUG("rxq=%p, wr_id=%" PRIu64 ":" " can't allocate a new mbuf", (void *)rxq, wr_id); - if (pkt_buf != NULL) + if (pkt_buf != NULL) { + *pkt_buf_next = NULL; rte_pktmbuf_free(pkt_buf); + } /* Increase out of memory counters. */ ++rxq->stats.rx_nombuf; ++rxq->priv->dev->data->rx_mbuf_alloc_failed; -- 2.20.1