diff options
| author | Ben Pfaff <blp@ovn.org> | 2018-01-25 15:39:46 -0800 |
|---|---|---|
| committer | Ben Pfaff <blp@ovn.org> | 2018-01-26 14:19:44 -0800 |
| commit | 05b1dd234aeee05bb702d682f0ffc59739a4ec9a (patch) | |
| tree | e715003a8661aa3f34c61553b07071abcb201cbc | |
| parent | 8df9a0c4108be3b1729fd72707d062008d74ef2e (diff) | |
| download | openvswitch-05b1dd234aeee05bb702d682f0ffc59739a4ec9a.tar.gz | |
ofproto: Avoid use-after-free on error path in ofproto_flow_mod_learn().
In the case where the learned flow limit has been reached (below_limit ==
false), ofproto_flow_mod_uninit() would unref ofm->temp_rule (which is
also in the 'rule' local variable) before dereferencing rule->flow_cookie
for the log message. This fixes the problem.
(The greatest likely consequence of this bug was logging the wrong cookie
value.)
Signed-off-by: Ben Pfaff <blp@ovn.org>
Acked-by: William Tu <u9012063@gmail.com>
| -rw-r--r-- | ofproto/ofproto.c | 10 |
1 files changed, 4 insertions, 6 deletions
diff --git a/ofproto/ofproto.c b/ofproto/ofproto.c index e776cd8b5..4f17f79d2 100644 --- a/ofproto/ofproto.c +++ b/ofproto/ofproto.c @@ -5140,15 +5140,13 @@ ofproto_flow_mod_learn(struct ofproto_flow_mod *ofm, bool keep_ref, ofproto_flow_mod_learn_finish(ofm, NULL); } } else { + static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(1, 5); + VLOG_INFO_RL(&rl, "Learn limit for flow %"PRIu64" reached.", + rule->flow_cookie); + ofproto_flow_mod_uninit(ofm); } ovs_mutex_unlock(&ofproto_mutex); - - if (!below_limit) { - static struct vlog_rate_limit learn_rl = VLOG_RATE_LIMIT_INIT(1, 5); - VLOG_INFO_RL(&learn_rl, "Learn limit for flow %"PRIu64" reached.", - rule->flow_cookie); - } } if (!keep_ref && below_limit) { |