summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorLi RongQing <roy.qing.li@gmail.com>2014-10-17 14:03:08 +0800
committerDavid S. Miller <davem@davemloft.net>2014-10-17 16:21:53 -0400
commit389f48947a5a37ea283de520abb742d42174edb0 (patch)
treeb49a5aed5e318b3be08c23025889522b9db48602
parent4062090e3e5caaf55bed4523a69f26c3265cc1d2 (diff)
downloadlinux-389f48947a5a37ea283de520abb742d42174edb0.tar.bz2
openvswitch: fix a use after free
pskb_may_pull() called by arphdr_ok can change skb->data, so put the arp setting after arphdr_ok to avoid the use the freed memory Fixes: 0714812134d7d ("openvswitch: Eliminate memset() from flow_extract.") Cc: Jesse Gross <jesse@nicira.com> Cc: Eric Dumazet <edumazet@google.com> Signed-off-by: Li RongQing <roy.qing.li@gmail.com> Acked-by: Jesse Gross <jesse@nicira.com> Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--net/openvswitch/flow.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
index 62db02ba36bc..c5cfc72a5535 100644
--- a/net/openvswitch/flow.c
+++ b/net/openvswitch/flow.c
@@ -557,10 +557,11 @@ static int key_extract(struct sk_buff *skb, struct sw_flow_key *key)
} else if (key->eth.type == htons(ETH_P_ARP) ||
key->eth.type == htons(ETH_P_RARP)) {
struct arp_eth_header *arp;
+ bool arp_available = arphdr_ok(skb);
arp = (struct arp_eth_header *)skb_network_header(skb);
- if (arphdr_ok(skb) &&
+ if (arp_available &&
arp->ar_hrd == htons(ARPHRD_ETHER) &&
arp->ar_pro == htons(ETH_P_IP) &&
arp->ar_hln == ETH_ALEN &&