From mboxrd@z Thu Jan  1 00:00:00 1970
From: Bruce Richardson <bruce.richardson@intel.com>
Subject: Re: [PATCH v3] net/mlx5: fix possible NULL deref in Rx
 path
Date: Mon, 19 Sep 2016 16:06:11 +0100
Message-ID: <20160919150611.GE45548@bricha3-MOBL3>
References: <1470148881-24115-1-git-send-email-sagi@grimberg.me>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Cc: dev@dpdk.org, Adrien Mazarguil <adrien.mazarguil@6wind.com>
To: Sagi Grimberg <sagi@grimberg.me>
Return-path: <dev-bounces@dpdk.org>
Received: from mga01.intel.com (mga01.intel.com [192.55.52.88])
 by dpdk.org (Postfix) with ESMTP id E292D2931
 for <dev@dpdk.org>; Mon, 19 Sep 2016 17:06:14 +0200 (CEST)
Content-Disposition: inline
In-Reply-To: <1470148881-24115-1-git-send-email-sagi@grimberg.me>
List-Id: patches and discussions about DPDK <dev.dpdk.org>
List-Unsubscribe: <http://dpdk.org/ml/options/dev>,
 <mailto:dev-request@dpdk.org?subject=unsubscribe>
List-Archive: <http://dpdk.org/ml/archives/dev/>
List-Post: <mailto:dev@dpdk.org>
List-Help: <mailto:dev-request@dpdk.org?subject=help>
List-Subscribe: <http://dpdk.org/ml/listinfo/dev>,
 <mailto:dev-request@dpdk.org?subject=subscribe>
Errors-To: dev-bounces@dpdk.org
Sender: "dev" <dev-bounces@dpdk.org>

On Tue, Aug 02, 2016 at 05:41:21PM +0300, Sagi Grimberg wrote:
> The user is allowed to call ->rx_pkt_burst() even without free
> mbufs in the pool. In this scenario we'll fail allocating a rep mbuf
> on the first iteration (where pkt is still NULL). This would cause us
> to deref a NULL pkt (reset refcount and free).
> 
> Fix this by checking the pkt before freeing it.
> 
> Fixes: a1bdb71a32da ("net/mlx5: fix crash in Rx")
> 
> Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
> Acked-by: Adrien Mazarguil <adrien.mazarguil@6wind.com>
> ---
Applied to dpdk-next-net/rel_16_11

/Bruce