diff options
author | Pravin B Shelar <pshelar@nicira.com> | 2012-06-07 15:18:17 -0700 |
---|---|---|
committer | Pravin B Shelar <pshelar@nicira.com> | 2012-06-07 16:47:30 -0700 |
commit | eebad56b6542e5018d28a6750b0979e80133bc6d (patch) | |
tree | a7d0dfefcf2ac1d8982d9f2935460c2b2d590716 /datapath | |
parent | 4ad71abb2f6bc4e6b99b768d90df69d7af816aed (diff) |
datapath: Fix use-after-free bug in dp_notify.
dp_notify, in unregister case, is accessing vport after detaching
it. Following patch fixes it.
Signed-off-by: Pravin B Shelar <pshelar@nicira.com>
Acked-by: Jesse Gross <jesse@nicira.com>
Diffstat (limited to 'datapath')
-rw-r--r-- | datapath/dp_notify.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/datapath/dp_notify.c b/datapath/dp_notify.c index 683f624d..13085d66 100644 --- a/datapath/dp_notify.c +++ b/datapath/dp_notify.c @@ -41,18 +41,19 @@ static int dp_device_event(struct notifier_block *unused, unsigned long event, case NETDEV_UNREGISTER: if (!ovs_is_internal_dev(dev)) { struct sk_buff *notify; + struct datapath *dp = vport->dp; notify = ovs_vport_cmd_build_info(vport, 0, 0, OVS_VPORT_CMD_DEL); ovs_dp_detach_port(vport); if (IS_ERR(notify)) { - netlink_set_err(GENL_SOCK(ovs_dp_get_net(vport->dp)), 0, + netlink_set_err(GENL_SOCK(ovs_dp_get_net(dp)), 0, ovs_dp_vport_multicast_group.id, PTR_ERR(notify)); break; } - genlmsg_multicast_netns(ovs_dp_get_net(vport->dp), notify, 0, + genlmsg_multicast_netns(ovs_dp_get_net(dp), notify, 0, ovs_dp_vport_multicast_group.id, GFP_KERNEL); } |