From: Roi Dayan <roid@nvidia.com>

Date: Mon, 14 Nov 2022 20:04:29 +0200

Subject: net/mlx5e: Fix use-after-free when reverting termination table

Patch-mainline: v6.1-rc8

Git-commit: 52c795af04441d76f565c4634f893e5b553df2ae

References: jsc#PED-1549

When having multiple dests with termination tables and second one

or afterwards fails the driver reverts usage of term tables but

doesn't reset the assignment in attr->dests[num_vport_dests].termtbl

which case a use-after-free when releasing the rule.

Fix by resetting the assignment of termtbl to null.

Fixes: 10caabdaad5a ("net/mlx5e: Use termination table for VLAN push actions")

Signed-off-by: Roi Dayan <roid@nvidia.com>

Reviewed-by: Maor Dickman <maord@nvidia.com>

Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>

Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>

---

 drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c |    2 ++

 1 file changed, 2 insertions(+)

--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c

+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c

@@ -312,6 +312,8 @@ revert_changes:

 	for (curr_dest = 0; curr_dest < num_vport_dests; curr_dest++) {

 		struct mlx5_termtbl_handle *tt = attr->dests[curr_dest].termtbl;

+		attr->dests[curr_dest].termtbl = NULL;

+

 		/* search for the destination associated with the

 		 * current term table

 		 */