[PATCH net] net: mvpp2: fix double free of the replaced rule in mvpp2_ethtool_cls_rule_ins()

[PATCH net] net: mvpp2: fix double free of the replaced rule in mvpp2_ethtool_cls_rule_ins()

[Thomas Fourier]

When a rule already exists at the requested location,
mvpp2_ethtool_cls_rule_ins() removes it from the hardware and frees it,
but leaves port->rfs_rules[loc] pointing at the freed structure. If
inserting the new rule then fails, the next rule insertion will free the
rule once again.

Clear the slot as soon as the old rule has been freed.

This bug was statically found and theoretical. Compile tested only.

Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
Fixes: 90b509b39ac9 ("net: mvpp2: cls: Add Classification offload support")
---
 drivers/net/ethernet/marvell/mvpp2/mvpp2_cls.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_cls.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_cls.c
index 80d15d7a5ec3..8ec94387cb57 100644
--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_cls.c
+++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_cls.c
@@ -1405,6 +1405,7 @@ int mvpp2_ethtool_cls_rule_ins(struct mvpp2_port *port,
 		if (ret)
 			goto clean_eth_rule;
 		kfree(old_efs);
+		port->rfs_rules[efs->rule.loc] = NULL;
 		port->n_rfs_rules--;
 	}
 
-- 
2.53.0