diff mbox

[ovs-dev] ofp-util: Avoid use-after-free error in ofputil_append_meter_config()

Message ID CABKoBm3ypdQx0gEBH012YcUx55Z+wS_UJpOWfdtLOr0Hk_4AdQ@mail.gmail.com
State Not Applicable
Headers show

Commit Message

Andy Zhou Dec. 23, 2015, 9:37 p.m. UTC
On Wed, Dec 23, 2015 at 9:26 AM, Ben Pfaff <blp@ovn.org> wrote:

> On Fri, Dec 18, 2015 at 02:51:43PM -0800, Andy Zhou wrote:
> > On Tue, Dec 15, 2015 at 10:51 PM, Ben Pfaff <blp@ovn.org> wrote:
> > > Reported-by: weizj <334965317@qq.com>
> > > Reported-at: https://github.com/openvswitch/ovs/pull/97
> > > Signed-off-by: Ben Pfaff <blp@ovn.org>
> >
> > This fix makes sense to me.
> > Acked-by: Andy Zhou <azhou@ovn.org>
>
> Thanks for the review.
>
> > If all assignments to 'reply' were grouped together, it may be
> > slightly easier to read.
>
> What do you mean?
>

This is what I mean.
     ofpmp_postappend(replies, start_ofs);
 }


> _______________________________________________
> dev mailing list
> dev@openvswitch.org
> http://openvswitch.org/mailman/listinfo/dev
>

Comments

Ben Pfaff Jan. 5, 2016, 1:06 a.m. UTC | #1
On Wed, Dec 23, 2015 at 01:37:23PM -0800, Andy Zhou wrote:
> On Wed, Dec 23, 2015 at 9:26 AM, Ben Pfaff <blp@ovn.org> wrote:
> 
> > On Fri, Dec 18, 2015 at 02:51:43PM -0800, Andy Zhou wrote:
> > > On Tue, Dec 15, 2015 at 10:51 PM, Ben Pfaff <blp@ovn.org> wrote:
> > > > Reported-by: weizj <334965317@qq.com>
> > > > Reported-at: https://github.com/openvswitch/ovs/pull/97
> > > > Signed-off-by: Ben Pfaff <blp@ovn.org>
> > >
> > > This fix makes sense to me.
> > > Acked-by: Andy Zhou <azhou@ovn.org>
> >
> > Thanks for the review.
> >
> > > If all assignments to 'reply' were grouped together, it may be
> > > slightly easier to read.
> >
> > What do you mean?
> >
> 
> This is what I mean.

I see, thanks.  I'll adjust the patch and apply this to appropriate
branches.
Ben Pfaff Jan. 5, 2016, 1:14 a.m. UTC | #2
On Mon, Jan 04, 2016 at 05:06:04PM -0800, Ben Pfaff wrote:
> On Wed, Dec 23, 2015 at 01:37:23PM -0800, Andy Zhou wrote:
> > On Wed, Dec 23, 2015 at 9:26 AM, Ben Pfaff <blp@ovn.org> wrote:
> > 
> > > On Fri, Dec 18, 2015 at 02:51:43PM -0800, Andy Zhou wrote:
> > > > On Tue, Dec 15, 2015 at 10:51 PM, Ben Pfaff <blp@ovn.org> wrote:
> > > > > Reported-by: weizj <334965317@qq.com>
> > > > > Reported-at: https://github.com/openvswitch/ovs/pull/97
> > > > > Signed-off-by: Ben Pfaff <blp@ovn.org>
> > > >
> > > > This fix makes sense to me.
> > > > Acked-by: Andy Zhou <azhou@ovn.org>
> > >
> > > Thanks for the review.
> > >
> > > > If all assignments to 'reply' were grouped together, it may be
> > > > slightly easier to read.
> > >
> > > What do you mean?
> > >
> > 
> > This is what I mean.
> 
> I see, thanks.  I'll adjust the patch and apply this to appropriate
> branches.

I wanted the backports to be trivial so I left the patch as-is and
posted a followup:
        https://patchwork.ozlabs.org/patch/562917/
Andy Zhou Jan. 5, 2016, 7:43 p.m. UTC | #3
Thanks!

On Mon, Jan 4, 2016 at 5:14 PM, Ben Pfaff <blp@ovn.org> wrote:

> On Mon, Jan 04, 2016 at 05:06:04PM -0800, Ben Pfaff wrote:
> > On Wed, Dec 23, 2015 at 01:37:23PM -0800, Andy Zhou wrote:
> > > On Wed, Dec 23, 2015 at 9:26 AM, Ben Pfaff <blp@ovn.org> wrote:
> > >
> > > > On Fri, Dec 18, 2015 at 02:51:43PM -0800, Andy Zhou wrote:
> > > > > On Tue, Dec 15, 2015 at 10:51 PM, Ben Pfaff <blp@ovn.org> wrote:
> > > > > > Reported-by: weizj <334965317@qq.com>
> > > > > > Reported-at: https://github.com/openvswitch/ovs/pull/97
> > > > > > Signed-off-by: Ben Pfaff <blp@ovn.org>
> > > > >
> > > > > This fix makes sense to me.
> > > > > Acked-by: Andy Zhou <azhou@ovn.org>
> > > >
> > > > Thanks for the review.
> > > >
> > > > > If all assignments to 'reply' were grouped together, it may be
> > > > > slightly easier to read.
> > > >
> > > > What do you mean?
> > > >
> > >
> > > This is what I mean.
> >
> > I see, thanks.  I'll adjust the patch and apply this to appropriate
> > branches.
>
> I wanted the backports to be trivial so I left the patch as-is and
> posted a followup:
>         https://patchwork.ozlabs.org/patch/562917/
>
diff mbox

Patch

diff --git a/lib/ofp-util.c b/lib/ofp-util.c
index 126b555..24d96f7 100644
--- a/lib/ofp-util.c
+++ b/lib/ofp-util.c
@@ -2033,13 +2033,16 @@  ofputil_append_meter_config(struct ovs_list
*replies,
 {
     struct ofpbuf *msg = ofpbuf_from_list(list_back(replies));
     size_t start_ofs = msg->size;
-    struct ofp13_meter_config *reply = ofpbuf_put_uninit(msg, sizeof
*reply);
-    reply->flags = htons(mc->flags);
-    reply->meter_id = htonl(mc->meter_id);
+    struct ofp13_meter_config *reply;

+    ofpbuf_put_uninit(msg, sizeof *reply);
     ofputil_put_bands(mc->n_bands, mc->bands, msg);

-    reply->length = htons(msg->size - start_ofs);
+    reply = ofpbuf_at_assert(msg, start_ofs, sizeof *reply);
+
+    reply->length= htons(msg->size - start_ofs);
+    reply->flags = htons(mc->flags);
+    reply->meter_id = htonl(mc->meter_id);