When rte_eth_dev_close() is called, it performs the following actions:

Calls dev->dev_ops->dev_close(), which in this case is dpaa2_dev_close().
Then calls rte_eth_dev_release_port(), which releases all device data
and sets dev->data to NULL.

Later, when rte_dev_remove() is called, the FSLMC bus invokes
dev->remove() — that is, rte_dpaa2_remove().
However, rte_dpaa2_remove() calls dpaa2_dev_close() again. Since dev->data
was already set to NULL by the previous call, this second invocation
causes a crash.

Fixes: 5964d36a2904 ("net/dpaa2: release port upon close")
Cc: sachin.saxena@nxp.com
Cc: stable@dpdk.org

Signed-off-by: Hemant Agrawal <hemant.agrawal@nxp.com>
Tested-by: Maxime Leroy <maxime@leroys.fr>
---
 drivers/net/dpaa2/dpaa2_ethdev.c | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_ethdev.c b/drivers/net/dpaa2/dpaa2_ethdev.c
index 7da32ce856..fcda267e0b 100644
--- a/drivers/net/dpaa2/dpaa2_ethdev.c
+++ b/drivers/net/dpaa2/dpaa2_ethdev.c
@@ -3347,14 +3347,22 @@ static int
 rte_dpaa2_remove(struct rte_dpaa2_device *dpaa2_dev)
 {
        struct rte_eth_dev *eth_dev;
-       int ret;
+       int ret = 0;
+
+       eth_dev = rte_eth_dev_allocated(dpaa2_dev->device.name);
+       if (eth_dev) {
+               ret = dpaa2_dev_close(eth_dev);
+               if (ret)
+                       DPAA2_PMD_ERR("dpaa2_dev_close ret= %d", ret);
+
+               ret = rte_eth_dev_release_port(eth_dev);
+       }

-       eth_dev = dpaa2_dev->eth_dev;
-       dpaa2_dev_close(eth_dev);
        dpaa2_valid_dev--;
-       if (!dpaa2_valid_dev)
+       if (!dpaa2_valid_dev) {
                rte_mempool_free(dpaa2_tx_sg_pool);
-       ret = rte_eth_dev_release_port(eth_dev);
+               dpaa2_tx_sg_pool = NULL;
+       }

        return ret;
 }
--
2.25.1