The table remove callback function is trying to destroy the
matchers list associated with table entries without checking
if the list is valid, which causes nullptr dereference.
Fixed by validating the matchers list before destroying it.
Issue can be reproduced with testpmd on Windows, when you run:
port close all
Fixes: 1872635570be ("net/mlx5: make matcher list thread safe")
Cc: [email protected]
Signed-off-by: Adham Masarwah <[email protected]>
Acked-by: Viacheslav Ovsiienko <[email protected]>
---
drivers/net/mlx5/mlx5_flow_dv.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/mlx5/mlx5_flow_dv.c b/drivers/net/mlx5/mlx5_flow_dv.c
index ef9c66eddf..baef252a7a 100644
--- a/drivers/net/mlx5/mlx5_flow_dv.c
+++ b/drivers/net/mlx5/mlx5_flow_dv.c
@@ -10503,7 +10503,8 @@ flow_dv_tbl_remove_cb(void *tool_ctx, struct
mlx5_list_entry *entry)
tbl_data->tunnel->tunnel_id : 0,
tbl_data->group_id);
}
- mlx5_list_destroy(tbl_data->matchers);
+ if (tbl_data->matchers)
+ mlx5_list_destroy(tbl_data->matchers);
mlx5_ipool_free(sh->ipool[MLX5_IPOOL_JUMP], tbl_data->idx);
}
--
2.16.1.windows.4
