Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6d670497 authored by Dan Carpenter's avatar Dan Carpenter Committed by David S. Miller
Browse files

openvswitch: use after free in __ovs_ct_free_action() 



We free "ct_info->ct" and then use it on the next line when we pass it
to nf_ct_destroy_timeout().  This patch swaps the order to avoid the use
after free.

Fixes: 06bd2bdf ("openvswitch: Add timeout support to ct action")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Acked-by: default avatarYi-Hung Wei <yihung.wei@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent f0dfecc9

net/openvswitch/conntrack.c

+1 −1
Original line number Diff line number Diff line
@@ -1804,9 +1804,9 @@ static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info) 
	if (ct_info->helper)

		nf_conntrack_helper_put(ct_info->helper);

	if (ct_info->ct) {

		nf_ct_tmpl_free(ct_info->ct);

		if (ct_info->timeout[0])

			nf_ct_destroy_timeout(ct_info->ct);

		nf_ct_tmpl_free(ct_info->ct);

	}

}