From patchwork Fri Feb 14 08:21:57 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dumitru Ceara X-Patchwork-Id: 1237923 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=openvswitch.org (client-ip=140.211.166.136; helo=silver.osuosl.org; envelope-from=ovs-dev-bounces@openvswitch.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=redhat.com Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=dDaYMiW1; dkim-atps=neutral Received: from silver.osuosl.org (smtp3.osuosl.org [140.211.166.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 48JmZZ1ZkRz9s29 for ; Fri, 14 Feb 2020 19:22:13 +1100 (AEDT) Received: from localhost (localhost [127.0.0.1]) by silver.osuosl.org (Postfix) with ESMTP id 0059F21F69; Fri, 14 Feb 2020 08:22:12 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from silver.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FjZNmkfqgfVY; Fri, 14 Feb 2020 08:22:10 +0000 (UTC) Received: from lists.linuxfoundation.org (lf-lists.osuosl.org [140.211.9.56]) by silver.osuosl.org (Postfix) with ESMTP id 9E6E32036D; Fri, 14 Feb 2020 08:22:10 +0000 (UTC) Received: from lf-lists.osuosl.org (localhost [127.0.0.1]) by lists.linuxfoundation.org (Postfix) with ESMTP id 7E4F3C07FE; Fri, 14 Feb 2020 08:22:10 +0000 (UTC) X-Original-To: dev@openvswitch.org Delivered-To: ovs-dev@lists.linuxfoundation.org Received: from hemlock.osuosl.org (smtp2.osuosl.org [140.211.166.133]) by lists.linuxfoundation.org (Postfix) with ESMTP id 16297C0177 for ; Fri, 14 Feb 2020 08:22:09 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by hemlock.osuosl.org (Postfix) with ESMTP id 003F287C66 for ; Fri, 14 Feb 2020 08:22:09 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from hemlock.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fUPYpidIcCZy for ; Fri, 14 Feb 2020 08:22:08 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6 Received: from us-smtp-1.mimecast.com (us-smtp-2.mimecast.com [205.139.110.61]) by hemlock.osuosl.org (Postfix) with ESMTPS id 20D0A87C63 for ; Fri, 14 Feb 2020 08:22:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1581668526; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=x5pDsfeHHf8CASnNohBLzgUOFLEwPAO4/0LHMxidyek=; b=dDaYMiW16fbQc9R4AD54xZp5siRtvIFN/xNULdz35Gd+IzLENaioW8ueTTesmU5t3z0/e8 +7YtXvSwKChhGY8WafwuvKVxHihuC3jYw1SMoevOptLB2T7kNmW1oXgR1PfyLDjklwnF5U YYU3HoarrCKupe/jVsJOGgS5OFT+pHQ= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-12-4VncL9bhPBi6UhbNDmjQ3g-1; Fri, 14 Feb 2020 03:22:04 -0500 Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.14]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 933F71083E8B; Fri, 14 Feb 2020 08:22:03 +0000 (UTC) Received: from dceara.remote.csb (ovpn-117-149.ams2.redhat.com [10.36.117.149]) by smtp.corp.redhat.com (Postfix) with ESMTP id 812185DA85; Fri, 14 Feb 2020 08:22:02 +0000 (UTC) From: Dumitru Ceara To: dev@openvswitch.org Date: Fri, 14 Feb 2020 09:21:57 +0100 Message-Id: <1581668517-10256-1-git-send-email-dceara@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.14 X-MC-Unique: 4VncL9bhPBi6UhbNDmjQ3g-1 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Cc: Han Zhou Subject: [ovs-dev] [PATCH branch-2.12] extend-table: Fix use after free in ovn_extend_table_clear. X-BeenThere: ovs-dev@openvswitch.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: ovs-dev-bounces@openvswitch.org Sender: "dev" CC: Han Zhou Fixes: d5001334f0f6 ("extend-table: Fix reusing group/meter by multiple logical flows.") Reported-by: Ben Pfaff Reported-at: https://mail.openvswitch.org/pipermail/ovs-dev/2020-February/367647.html Signed-off-by: Dumitru Ceara (cherry picked from ovn commit 22d9a6f35551e3078394d5f8849055f43638e0d1) --- ovn/lib/extend-table.c | 38 ++++++++++++++++++++++++-------------- 1 file changed, 24 insertions(+), 14 deletions(-) diff --git a/ovn/lib/extend-table.c b/ovn/lib/extend-table.c index 18e16f7..95768f1 100644 --- a/ovn/lib/extend-table.c +++ b/ovn/lib/extend-table.c @@ -25,6 +25,10 @@ VLOG_DEFINE_THIS_MODULE(extend_table); +static void +ovn_extend_table_delete_desired(struct ovn_extend_table *table, + struct ovn_extend_table_lflow_to_desired *l); + void ovn_extend_table_init(struct ovn_extend_table *table) { @@ -173,8 +177,7 @@ ovn_extend_table_clear(struct ovn_extend_table *table, bool existing) if (!existing) { struct ovn_extend_table_lflow_to_desired *l, *l_next; HMAP_FOR_EACH_SAFE (l, l_next, hmap_node, &table->lflow_to_desired) { - hmap_remove(&table->lflow_to_desired, &l->hmap_node); - free(l); + ovn_extend_table_delete_desired(table, l); } } @@ -214,18 +217,10 @@ ovn_extend_table_remove_existing(struct ovn_extend_table *table, ovn_extend_table_info_destroy(existing); } -/* Remove entries in desired table that are created by the lflow_uuid */ -void -ovn_extend_table_remove_desired(struct ovn_extend_table *table, - const struct uuid *lflow_uuid) +static void +ovn_extend_table_delete_desired(struct ovn_extend_table *table, + struct ovn_extend_table_lflow_to_desired *l) { - struct ovn_extend_table_lflow_to_desired *l = - ovn_extend_table_find_desired_by_lflow(table, lflow_uuid); - - if (!l) { - return; - } - hmap_remove(&table->lflow_to_desired, &l->hmap_node); struct ovn_extend_table_lflow_ref *r, *next_r; LIST_FOR_EACH_SAFE (r, next_r, list_node, &l->desired) { @@ -233,7 +228,7 @@ ovn_extend_table_remove_desired(struct ovn_extend_table *table, ovn_extend_info_del_lflow_ref(r); if (hmap_is_empty(&e->references)) { VLOG_DBG("%s: %s, "UUID_FMT, __func__, - e->name, UUID_ARGS(lflow_uuid)); + e->name, UUID_ARGS(&l->lflow_uuid)); hmap_remove(&table->desired, &e->hmap_node); if (e->new_table_id) { bitmap_set0(table->table_ids, e->table_id); @@ -244,6 +239,21 @@ ovn_extend_table_remove_desired(struct ovn_extend_table *table, free(l); } +/* Remove entries in desired table that are created by the lflow_uuid */ +void +ovn_extend_table_remove_desired(struct ovn_extend_table *table, + const struct uuid *lflow_uuid) +{ + struct ovn_extend_table_lflow_to_desired *l = + ovn_extend_table_find_desired_by_lflow(table, lflow_uuid); + + if (!l) { + return; + } + + ovn_extend_table_delete_desired(table, l); +} + static struct ovn_extend_table_info* ovn_extend_info_clone(struct ovn_extend_table_info *source) {