From: Jie Liu <[email protected]> sxe2_tx_queue_mbufs_release_vec() calls rte_pktmbuf_free_seg() on each buffer entry without checking for NULL. rte_pktmbuf_free_seg() does not tolerate NULL and dereferences its argument, so a stop/start cycle or any unwritten slot in the release range can crash.
Restore the NULL check before freeing each mbuf. Cc: [email protected] Cc: [email protected] Signed-off-by: Jie Liu <[email protected]> --- drivers/net/sxe2/sxe2_txrx_vec.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/drivers/net/sxe2/sxe2_txrx_vec.c b/drivers/net/sxe2/sxe2_txrx_vec.c index 05940c8cb5..7c5da33dd5 100644 --- a/drivers/net/sxe2/sxe2_txrx_vec.c +++ b/drivers/net/sxe2/sxe2_txrx_vec.c @@ -183,15 +183,19 @@ static void sxe2_tx_queue_mbufs_release_vec(struct sxe2_tx_queue *txq) if (txq->next_use < i) { for ( ; i < txq->ring_depth; ++i) { - rte_pktmbuf_free_seg(buffer_vec[i].mbuf); - buffer_vec[i].mbuf = NULL; + if (buffer_vec[i].mbuf != NULL) { + rte_pktmbuf_free_seg(buffer_vec[i].mbuf); + buffer_vec[i].mbuf = NULL; + } } i = 0; } for ( ; i < txq->next_use; ++i) { - rte_pktmbuf_free_seg(buffer_vec[i].mbuf); - buffer_vec[i].mbuf = NULL; + if (buffer_vec[i].mbuf != NULL) { + rte_pktmbuf_free_seg(buffer_vec[i].mbuf); + buffer_vec[i].mbuf = NULL; + } } } -- 2.52.0
