[PATCH net v1] net/mlx5: Fix HWS action unwind NULL dereference

[Prathamesh Deshpande]

mlx5_fs_fte_get_hws_actions() stores some destination actions in
fs_actions[] before checking whether action creation succeeded.

If creating a table-number or range destination action fails, or if
fetching a sampler destination action fails, dest_action is NULL but
num_fs_actions has already been incremented. The shared error path then
calls mlx5_fs_destroy_fs_action(), which dereferences fs_action->action
to get the HWS action type, causing a NULL pointer dereference while
unwinding the original failure.

Track whether the current destination action needs fs_actions[] cleanup,
but append it only after dest_action has been validated.

Fixes: 2ec6786ad0a6b ("net/mlx5: fs, add HWS fte API functions")
Fixes: 32e658c84b6d ("net/mlx5: fs, add support for dest flow sampler HWS action")
Signed-off-by: Prathamesh Deshpande <prathameshdeshpande7@xxxxxxxxx>
---
 .../mellanox/mlx5/core/steering/hws/fs_hws.c     | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c
index aca77853abb8..fb12513dd83d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c
@@ -950,6 +950,7 @@ static int mlx5_fs_fte_get_hws_actions(struct mlx5_flow_root_namespace *ns,
 			struct mlx5_flow_destination *attr = &dst->dest_attr;
 			bool type_uplink =
 				attr->type == MLX5_FLOW_DESTINATION_TYPE_UPLINK;
+			bool record_fs_action = false;
 
 			if (num_fs_actions == MLX5_FLOW_CONTEXT_ACTION_MAX ||
 			    num_dest_actions == MLX5_FLOW_CONTEXT_ACTION_MAX) {
@@ -973,11 +974,11 @@ static int mlx5_fs_fte_get_hws_actions(struct mlx5_flow_root_namespace *ns,
 					break;
 				dest_action = mlx5_fs_create_dest_action_table_num(fs_ctx,
 										   dst);
-				fs_actions[num_fs_actions++].action = dest_action;
+				record_fs_action = true;
 				break;
 			case MLX5_FLOW_DESTINATION_TYPE_RANGE:
 				dest_action = mlx5_fs_create_dest_action_range(ctx, dst);
-				fs_actions[num_fs_actions++].action = dest_action;
+				record_fs_action = true;
 				break;
 			case MLX5_FLOW_DESTINATION_TYPE_UPLINK:
 			case MLX5_FLOW_DESTINATION_TYPE_VPORT:
@@ -988,9 +989,7 @@ static int mlx5_fs_fte_get_hws_actions(struct mlx5_flow_root_namespace *ns,
 				dest_action =
 					mlx5_fs_get_dest_action_sampler(fs_ctx,
 									dst);
-				fs_actions[num_fs_actions].action = dest_action;
-				fs_actions[num_fs_actions++].sampler_id =
-							dst->dest_attr.sampler_id;
+				record_fs_action = true;
 				break;
 			default:
 				err = -EOPNOTSUPP;
@@ -1000,6 +999,13 @@ static int mlx5_fs_fte_get_hws_actions(struct mlx5_flow_root_namespace *ns,
 				err = -ENOMEM;
 				goto free_actions;
 			}
+			if (record_fs_action) {
+				fs_actions[num_fs_actions].action = dest_action;
+				if (attr->type == MLX5_FLOW_DESTINATION_TYPE_FLOW_SAMPLER)
+					fs_actions[num_fs_actions].sampler_id =
+								dst->dest_attr.sampler_id;
+				num_fs_actions++;
+			}
 			dest_actions[num_dest_actions++].dest = dest_action;
 		}
 	}
-- 
2.43.0