SW completion ring of Tx (txq->elts) stores individual mbufs even if a
multi-segmented packet is sent. rte_pktmbuf_free_seg() must be used when
cleaning up the completion ring. Otherwise, chained mbufs are redundantly
freed and finally it would cause a crash.

CC: stable@dpdk.org
Fixes: 1d88ba171942 ("net/mlx5: refactor Tx data path")

Signed-off-by: Yongseok Koh <redacted>
---
 drivers/net/mlx5/mlx5_txq.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/mlx5/mlx5_txq.c b/drivers/net/mlx5/mlx5_txq.c
index 6c1387e56..bf72468d5 100644
--- a/drivers/net/mlx5/mlx5_txq.c
+++ b/drivers/net/mlx5/mlx5_txq.c

@@ -117,7 +117,7 @@ txq_free_elts(struct txq_ctrl *txq_ctrl)
 		struct rte_mbuf *elt = (*elts)[elts_tail];
 
 		assert(elt != NULL);
-		rte_pktmbuf_free(elt);
+		rte_pktmbuf_free_seg(elt);
 #ifndef NDEBUG
 		/* Poisoning. */
 		memset(&(*elts)[elts_tail],

-- 
2.11.0