Commit 05b1dd23 authored by Ben Pfaff's avatar Ben Pfaff

ofproto: Avoid use-after-free on error path in ofproto_flow_mod_learn().

In the case where the learned flow limit has been reached (below_limit ==
false), ofproto_flow_mod_uninit() would unref ofm->temp_rule (which is
also in the 'rule' local variable) before dereferencing rule->flow_cookie
for the log message.  This fixes the problem.

(The greatest likely consequence of this bug was logging the wrong cookie
value.)
Signed-off-by: default avatarBen Pfaff <blp@ovn.org>
Acked-by: default avatarWilliam Tu <u9012063@gmail.com>
parent 8df9a0c4
......@@ -5140,15 +5140,13 @@ ofproto_flow_mod_learn(struct ofproto_flow_mod *ofm, bool keep_ref,
ofproto_flow_mod_learn_finish(ofm, NULL);
}
} else {
static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(1, 5);
VLOG_INFO_RL(&rl, "Learn limit for flow %"PRIu64" reached.",
rule->flow_cookie);
ofproto_flow_mod_uninit(ofm);
}
ovs_mutex_unlock(&ofproto_mutex);
if (!below_limit) {
static struct vlog_rate_limit learn_rl = VLOG_RATE_LIMIT_INIT(1, 5);
VLOG_INFO_RL(&learn_rl, "Learn limit for flow %"PRIu64" reached.",
rule->flow_cookie);
}
}
if (!keep_ref && below_limit) {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment