From: Shay Drory <shayd@nvidia.com> mainline inclusion from mainline-v7.2-rc3 commit 0f0e4ae6975c773f7854fc48932a267f6c79088f category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17727 CVE: CVE-2026-72345 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=... -------------------------------- On failure at index i, the reverse cleanup loop in mlx5_lag_create_single_fdb() starts from i, so the failed index itself is rolled back. That can operate on uninitialized state or double-tear-down a rule the add_one path already self-rolled-back. Start the rollback from i - 1 so only successfully-installed entries are undone. Fixes: ddbb5ddc43ad ("net/mlx5: LAG, Refactor lag logic") Signed-off-by: Shay Drory <shayd@nvidia.com> Reviewed-by: Mark Bloch <mbloch@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260630112917.698313-2-tariqt@nvidia.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> Conflicts: drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c [Commit 3b8b364f97f40 which factored shared FDB code into shared_fdb.c is not present in this tree; mlx5_lag_create_single_fdb() still lives in lag.c. Apply the same off-by-one rollback fix there by starting the reverse cleanup at i-1 instead of i.] Signed-off-by: Yi Yang <yiyang13@huawei.com> --- drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c index f6b1ac80c0af..96b1eb0ec72d 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c @@ -570,7 +570,7 @@ static int mlx5_lag_create_single_fdb(struct mlx5_lag *ldev) } return 0; err: - for (; i > MLX5_LAG_P1; i--) + for (i--; i > MLX5_LAG_P1; i--) mlx5_eswitch_offloads_single_fdb_del_one(master_esw, ldev->pf[i].dev->priv.eswitch); return err; -- 2.25.1