DORMANTno replies

[PATCH net 1/4] openvswitch: Fix a double free bug for the sample action

From: Pravin B Shelar <hidden>
Date: 2014-07-01 06:34:30
Subsystem: networking [general], openvswitch, the rest · Maintainers: "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Aaron Conole, Eelco Chaudron, Ilya Maximets, Linus Torvalds

From: Andy Zhou <redacted>

When sample action returns with an error, the skb has already been
freed. This patch fix a bug to make sure we don't free it again.
This bug introduced by commit ccb1352e76cff05 (net: Add Open vSwitch
kernel components.)

Signed-off-by: Andy Zhou <redacted>
Signed-off-by: Pravin B Shelar <redacted>
---
 net/openvswitch/actions.c | 2 ++
 1 file changed, 2 insertions(+)
diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
index c36856a..e70d8b1 100644
--- a/net/openvswitch/actions.c
+++ b/net/openvswitch/actions.c
@@ -551,6 +551,8 @@ static int do_execute_actions(struct datapath *dp, struct sk_buff *skb,
 
 		case OVS_ACTION_ATTR_SAMPLE:
 			err = sample(dp, skb, a);
+			if (unlikely(err)) /* skb already freed. */
+				return err;
 			break;
 		}
 
-- 
1.9.3
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help