diff options
| author | Paolo Valerio <pvalerio@redhat.com> | 2022-03-11 21:38:45 +0100 |
|---|---|---|
| committer | Ilya Maximets <i.maximets@ovn.org> | 2022-04-04 21:29:37 +0200 |
| commit | 0027b3b46c759b65df9533b52166da7bbf3b96a1 (patch) | |
| tree | c94f8cb12b5bbf8178789a2f064efe06de171d48 /ofproto | |
| parent | efa6f1f2e0c97e058fae0161653aab50168226b5 (diff) | |
| download | openvswitch-0027b3b46c759b65df9533b52166da7bbf3b96a1.tar.gz | |
ofproto-dpif-xlate: Fix NULL pointer dereference in xlate_normal().
Considering the following flows:
ovs-ofctl dump-flows br0
cookie=0x0, table=0, priority=0 actions=NORMAL
and assuming a packet originated from packet-out in this way:
ovs-ofctl packet-out br0 \
"in_port=controller,packet=<UDP packet>,action=ct(table=0)"
If in_port is OFPP_NONE or OFPP_CONTROLLER, this leads to a
NULL pointer (xport) dereference in xlate_normal().
Fix it by checking the xport pointer validity while deciding whether
it is a candidate for mac learning or not.
Acked-by: Eelco Chaudron <echaudro@redhat.com>
Signed-off-by: Paolo Valerio <pvalerio@redhat.com>
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
Diffstat (limited to 'ofproto')
| -rw-r--r-- | ofproto/ofproto-dpif-xlate.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/ofproto/ofproto-dpif-xlate.c b/ofproto/ofproto-dpif-xlate.c index bfd4960dd..5a770f171 100644 --- a/ofproto/ofproto-dpif-xlate.c +++ b/ofproto/ofproto-dpif-xlate.c @@ -3032,7 +3032,7 @@ xlate_normal(struct xlate_ctx *ctx) bool is_grat_arp = is_gratuitous_arp(flow, wc); if (ctx->xin->allow_side_effects && flow->packet_type == htonl(PT_ETH) - && in_port->pt_mode != NETDEV_PT_LEGACY_L3 + && in_port && in_port->pt_mode != NETDEV_PT_LEGACY_L3 ) { update_learning_table(ctx, in_xbundle, flow->dl_src, vlan, is_grat_arp); |