[PATCH] net/bnxt: fix memory corruption in tunnel entry list

[Manish Kurup]

From: Kishore Padmanabha <kishore.padmanabha at broadcom.com>

When the app tunnel table is full, ref_cnt is never zero, so
free_entry ends up as -1 and the wrong tunnel slot gets updated.
Use the correct index instead of free_entry.

Fixes: bdf4a3c6316b ("net/bnxt: support tunnel offload")
Cc: stable at dpdk.org

Signed-off-by: Kishore Padmanabha <kishore.padmanabha at broadcom.com>
Signed-off-by: Manish Kurup <manish.kurup at broadcom.com>
---
 drivers/net/bnxt/tf_ulp/ulp_tun.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/bnxt/tf_ulp/ulp_tun.c b/drivers/net/bnxt/tf_ulp/ulp_tun.c
index b90b4bf252..8ecdac0dcc 100644
--- a/drivers/net/bnxt/tf_ulp/ulp_tun.c
+++ b/drivers/net/bnxt/tf_ulp/ulp_tun.c
@@ -33,7 +33,7 @@ ulp_app_tun_search_entry(struct bnxt_ulp_context *ulp_ctx,
 				    app_tunnel,
 				    sizeof(struct rte_flow_tunnel))) {
 				*tun_entry =  &tun_ent_list[i];
-				tun_ent_list[free_entry].ref_cnt++;
+				tun_ent_list[i].ref_cnt++;
 				return rc;
 			}
 		}
-- 
2.31.1