| Message ID | 20190402065314.GA14444@kadam |
|---|---|
| State | Awaiting Upstream |
| Headers | show |
| Series | [ovs-dev,net-next] openvswitch: use after free in __ovs_ct_free_action() | expand |
On Mon, Apr 1, 2019 at 11:53 PM Dan Carpenter <dan.carpenter@oracle.com> wrote: > > We free "ct_info->ct" and then use it on the next line when we pass it > to nf_ct_destroy_timeout(). This patch swaps the order to avoid the use > after free. > > Fixes: 06bd2bdf19d2 ("openvswitch: Add timeout support to ct action") > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > --- Thanks for the fix. Acked-by: Yi-Hung Wei <yihung.wei@gmail.com>
From: Dan Carpenter <dan.carpenter@oracle.com> Date: Tue, 2 Apr 2019 09:53:14 +0300 > We free "ct_info->ct" and then use it on the next line when we pass it > to nf_ct_destroy_timeout(). This patch swaps the order to avoid the use > after free. > > Fixes: 06bd2bdf19d2 ("openvswitch: Add timeout support to ct action") > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Applied, thanks.
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c index 121b01d4a3c0..0be3ab5bde26 100644 --- a/net/openvswitch/conntrack.c +++ b/net/openvswitch/conntrack.c @@ -1804,9 +1804,9 @@ static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info) if (ct_info->helper) nf_conntrack_helper_put(ct_info->helper); if (ct_info->ct) { - nf_ct_tmpl_free(ct_info->ct); if (ct_info->timeout[0]) nf_ct_destroy_timeout(ct_info->ct); + nf_ct_tmpl_free(ct_info->ct); } }
We free "ct_info->ct" and then use it on the next line when we pass it to nf_ct_destroy_timeout(). This patch swaps the order to avoid the use after free. Fixes: 06bd2bdf19d2 ("openvswitch: Add timeout support to ct action") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- net/openvswitch/conntrack.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)