Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0a2d73a7 authored by Roi Dayan's avatar Roi Dayan Committed by Greg Kroah-Hartman
Browse files

net/mlx5e: Fix use-after-free when reverting termination table 



[ Upstream commit 52c795af04441d76f565c4634f893e5b553df2ae ]

When having multiple dests with termination tables and second one
or afterwards fails the driver reverts usage of term tables but
doesn't reset the assignment in attr->dests[num_vport_dests].termtbl
which case a use-after-free when releasing the rule.
Fix by resetting the assignment of termtbl to null.

Fixes: 10caabda ("net/mlx5e: Use termination table for VLAN push actions")
Signed-off-by: default avatarRoi Dayan <roid@nvidia.com>
Reviewed-by: default avatarMaor Dickman <maord@nvidia.com>
Signed-off-by: default avatarSaeed Mahameed <saeedm@nvidia.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 093ccc2f

drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c

+2 −0
Original line number Diff line number Diff line
@@ -267,6 +267,8 @@ mlx5_eswitch_add_termtbl_rule(struct mlx5_eswitch *esw, 
	for (curr_dest = 0; curr_dest < num_vport_dests; curr_dest++) {

		struct mlx5_termtbl_handle *tt = attr->dests[curr_dest].termtbl;



		attr->dests[curr_dest].termtbl = NULL;



		/* search for the destination associated with the

		 * current term table

		 */