Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 389f4894 authored by Li RongQing's avatar Li RongQing Committed by David S. Miller
Browse files

openvswitch: fix a use after free 



pskb_may_pull() called by arphdr_ok can change skb->data, so put the arp
setting after arphdr_ok to avoid the use the freed memory

Fixes: 07148121 ("openvswitch: Eliminate memset() from flow_extract.")
Cc: Jesse Gross <jesse@nicira.com>
Cc: Eric Dumazet <edumazet@google.com>
Signed-off-by: default avatarLi RongQing <roy.qing.li@gmail.com>
Acked-by: default avatarJesse Gross <jesse@nicira.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 4062090e

net/openvswitch/flow.c

+2 −1
Original line number Diff line number Diff line
@@ -557,10 +557,11 @@ static int key_extract(struct sk_buff *skb, struct sw_flow_key *key) 
	} else if (key->eth.type == htons(ETH_P_ARP) ||

		   key->eth.type == htons(ETH_P_RARP)) {

		struct arp_eth_header *arp;

		bool arp_available = arphdr_ok(skb);



		arp = (struct arp_eth_header *)skb_network_header(skb);



		if (arphdr_ok(skb) &&

		if (arp_available &&

		    arp->ar_hrd == htons(ARPHRD_ETHER) &&

		    arp->ar_pro == htons(ETH_P_IP) &&

		    arp->ar_hln == ETH_ALEN &&