net/mlx5: Use mlx5_ipsec_rx_status_destroy to correctly delete status rules

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Use mlx5_ipsec_rx_status_destroy to correctly delete status rules

rx_create no longer allocates a modify_hdr instance that needs to be

cleaned up. The mlx5_modify_header_dealloc call will lead to a NULL pointer

dereference. A leak in the rules also previously occurred since there are

now two rules populated related to status.

BUG: kernel NULL pointer dereference, address: 0000000000000000

#PF: supervisor read access in kernel mode

#PF: error_code(0x0000) - not-present page

PGD 109907067 P4D 109907067 PUD 116890067 PMD 0

Oops: 0000 [#1] SMP

CPU: 1 PID: 484 Comm: ip Not tainted 6.9.0-rc2-rrameshbabu+ #254

Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS Arch Linux 1.16.3-1-1 04/01/2014

RIP: 0010:mlx5_modify_header_dealloc+0xd/0x70

<snip>

Call Trace:

<TASK>

? show_regs+0x60/0x70

? __die+0x24/0x70

? page_fault_oops+0x15f/0x430

? free_to_partial_list.constprop.0+0x79/0x150

? do_user_addr_fault+0x2c9/0x5c0

? exc_page_fault+0x63/0x110

? asm_exc_page_fault+0x27/0x30

? mlx5_modify_header_dealloc+0xd/0x70

rx_create+0x374/0x590

rx_add_rule+0x3ad/0x500

? rx_add_rule+0x3ad/0x500

? mlx5_cmd_exec+0x2c/0x40

? mlx5_create_ipsec_obj+0xd6/0x200

mlx5e_accel_ipsec_fs_add_rule+0x31/0xf0

mlx5e_xfrm_add_state+0x426/0xc00

<snip>