Commit 05b1dd23 authored by Ben Pfaff's avatar Ben Pfaff

ofproto: Avoid use-after-free on error path in ofproto_flow_mod_learn().

In the case where the learned flow limit has been reached (below_limit ==
false), ofproto_flow_mod_uninit() would unref ofm->temp_rule (which is
also in the 'rule' local variable) before dereferencing rule->flow_cookie
for the log message.  This fixes the problem.

(The greatest likely consequence of this bug was logging the wrong cookie
Signed-off-by: default avatarBen Pfaff <>
Acked-by: default avatarWilliam Tu <>
parent 8df9a0c4
......@@ -5140,15 +5140,13 @@ ofproto_flow_mod_learn(struct ofproto_flow_mod *ofm, bool keep_ref,
ofproto_flow_mod_learn_finish(ofm, NULL);
} else {
static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(1, 5);
VLOG_INFO_RL(&rl, "Learn limit for flow %"PRIu64" reached.",
if (!below_limit) {
static struct vlog_rate_limit learn_rl = VLOG_RATE_LIMIT_INIT(1, 5);
VLOG_INFO_RL(&learn_rl, "Learn limit for flow %"PRIu64" reached.",
if (!keep_ref && below_limit) {
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment