From: Kishore Padmanabha <[email protected]>
In ulp_app_tun_search_entry(), when a matching tunnel entry is found
at index i, the reference count was incremented on
tun_ent_list[free_entry] instead of tun_ent_list[i]. free_entry is -1
when no unused slot precedes the match (always the case when the table
is full), so this wrote before the start of the array; otherwise it
bumped the count of an unused slot and left the matched entry's count
unchanged. Use the matching index.
Fixes: bdf4a3c6316b ("net/bnxt: support tunnel offload")
Cc: [email protected]
Signed-off-by: Kishore Padmanabha <[email protected]>
Signed-off-by: Manish Kurup <[email protected]>
Signed-off-by: Mohammad Shuab Siddique <[email protected]>
---
v2:
- Reword the commit message: free_entry is -1 whenever no unused slot precedes
the matching entry, not only when the table is full
- No code change
drivers/net/bnxt/tf_ulp/ulp_tun.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/bnxt/tf_ulp/ulp_tun.c
b/drivers/net/bnxt/tf_ulp/ulp_tun.c
index b90b4bf2523..8ecdac0dcce 100644
--- a/drivers/net/bnxt/tf_ulp/ulp_tun.c
+++ b/drivers/net/bnxt/tf_ulp/ulp_tun.c
@@ -33,7 +33,7 @@ ulp_app_tun_search_entry(struct bnxt_ulp_context *ulp_ctx,
app_tunnel,
sizeof(struct rte_flow_tunnel))) {
*tun_entry = &tun_ent_list[i];
- tun_ent_list[free_entry].ref_cnt++;
+ tun_ent_list[i].ref_cnt++;
return rc;
}
}
--
2.47.3
