[PATCH v2 02/26] net/hinic3: fix double removal in ethertype flow destroy

[Jiacheng Ye]

The ethertype destroy path removes the same flow node from
filter_ethertype_list twice, corrupting the tailq and leading to
use-after-free. Drop the redundant removal.

Fixes: efa3b9b36fc7 ("net/hinic3: add flow control and filters")
Cc: sta...@dpdk.org

Signed-off-by: Jiacheng Ye <yejiache...@h-partners.com>
---
 drivers/net/hinic3/hinic3_flow.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/drivers/net/hinic3/hinic3_flow.c b/drivers/net/hinic3/hinic3_flow.c
index 5c255619e3..453b4369b3 100644
--- a/drivers/net/hinic3/hinic3_flow.c
+++ b/drivers/net/hinic3/hinic3_flow.c
@@ -1332,10 +1332,6 @@ hinic3_flow_destroy(struct rte_eth_dev *dev, struct 
rte_flow *flow,
                        &rules->ethertype_filter, false);
                if (!ret)
                        TAILQ_REMOVE(&nic_dev->filter_ethertype_list, flow, 
node);
-
-               flow->rule = rules;
-               flow->filter_type = rules->filter_type;
-               TAILQ_REMOVE(&nic_dev->filter_ethertype_list, flow, node);
                break;
 
        case RTE_ETH_FILTER_FDIR:
-- 
2.33.0