[PATCH 3/5] net/bnxt: fix use-after-free in VNIC filter cleanup

[Mohammad Shuab Siddique]

From: Mohammad Shuab Siddique <mohammad-shuab.siddique at broadcom.com>

STAILQ_FOREACH()'s own advance step dereferences the current node's
next field after the loop body runs. The loop body here frees that
same node (bnxt_free_filter()) before the macro dereferences it on
the next iteration, so the filter list walk in
bnxt_clear_hwrm_vnic_filters() reads freed memory to find the
following entry.

Walk the list with STAILQ_FIRST()/STAILQ_REMOVE_HEAD() instead,
removing each filter from the list before freeing it so nothing is
dereferenced after being freed.

Fixes: 20ef524432dd ("net/bnxt: set L2 filters")
Cc: stable at dpdk.org

Signed-off-by: Mohammad Shuab Siddique <mohammad-shuab.siddique at broadcom.com>
---
 drivers/net/bnxt/bnxt_hwrm.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/bnxt/bnxt_hwrm.c b/drivers/net/bnxt/bnxt_hwrm.c
index 765aa7c452..99539d3705 100644
--- a/drivers/net/bnxt/bnxt_hwrm.c
+++ b/drivers/net/bnxt/bnxt_hwrm.c
@@ -3593,9 +3593,10 @@ bnxt_clear_hwrm_vnic_filters(struct bnxt *bp, struct bnxt_vnic_info *vnic)
 	struct bnxt_filter_info *filter;
 	int rc = 0;
 
-	STAILQ_FOREACH(filter, &vnic->filter, next) {
+	while (!STAILQ_EMPTY(&vnic->filter)) {
+		filter = STAILQ_FIRST(&vnic->filter);
 		rc = bnxt_clear_one_vnic_filter(bp, filter);
-		STAILQ_REMOVE(&vnic->filter, filter, bnxt_filter_info, next);
+		STAILQ_REMOVE_HEAD(&vnic->filter, next);
 		bnxt_free_filter(bp, filter);
 	}
 	return rc;
-- 
2.47.3