net/mlx5e: TC, Fix use after free in mlx5e_clone_flow_attr_for_post_act()

This returns freed memory leading to a use after free.  It's supposed to
return NULL.

Fixes: 8300f225268b ("net/mlx5e: Create new flow attr for multi table actions")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Roi Dayan <roid@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 40416e0a8bb193f5d64ee4c26aca37126657fbac..e3fc15ae7bb106a055dad73466790accb04a6798 100644 (file)
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -3410,7 +3410,7 @@ mlx5e_clone_flow_attr_for_post_act(struct mlx5_flow_attr *attr,
        if (!attr2 || !parse_attr) {
                kvfree(parse_attr);
                kfree(attr2);
-               return attr2;
+               return NULL;
        }
 
        memcpy(attr2, attr, attr_sz);