diff options
| author |   Li RongQing <roy.qing.li@gmail.com> | 2014-10-17 14:03:08 +0800 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2014-10-17 16:21:53 -0400 |
| commit | 389f48947a5a37ea283de520abb742d42174edb0 (patch) | |
| tree | b49a5aed5e318b3be08c23025889522b9db48602 /net/openvswitch/flow.c | |
| parent | ipv4: dst_entry leak in ip_send_unicast_reply() (diff) | |
| download | linux-dev-389f48947a5a37ea283de520abb742d42174edb0.tar.xz linux-dev-389f48947a5a37ea283de520abb742d42174edb0.zip | |
openvswitch: fix a use after free
pskb_may_pull() called by arphdr_ok can change skb->data, so put the arp
setting after arphdr_ok to avoid the use the freed memory
Fixes: 0714812134d7d ("openvswitch: Eliminate memset() from flow_extract.")
Cc: Jesse Gross <jesse@nicira.com>
Cc: Eric Dumazet <edumazet@google.com>
Signed-off-by: Li RongQing <roy.qing.li@gmail.com>
Acked-by: Jesse Gross <jesse@nicira.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/openvswitch/flow.c')
| -rw-r--r-- | net/openvswitch/flow.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c index 62db02ba36bc..c5cfc72a5535 100644 --- a/net/openvswitch/flow.c +++ b/net/openvswitch/flow.c @@ -557,10 +557,11 @@ static int key_extract(struct sk_buff *skb, struct sw_flow_key *key) } else if (key->eth.type == htons(ETH_P_ARP) || key->eth.type == htons(ETH_P_RARP)) { struct arp_eth_header *arp; + bool arp_available = arphdr_ok(skb); arp = (struct arp_eth_header *)skb_network_header(skb); - if (arphdr_ok(skb) && + if (arp_available && arp->ar_hrd == htons(ARPHRD_ETHER) && arp->ar_pro == htons(ETH_P_IP) && arp->ar_hln == ETH_ALEN && |