From: Ben Pfaff <blp@nicira.com>
Date: Thu, 28 Apr 2011 23:34:56 +0000 (-0700)
Subject: datapath: Avoid freeing wild pointer in corner case.
X-Git-Url: https://pintos-os.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6f04e94a264edae76aa2bb44a9019e19b29d47a1;p=openvswitch

datapath: Avoid freeing wild pointer in corner case.

In odp_flow_cmd_new_or_set(), if flow_actions_alloc() fails in the "new
flow" case, then flow_put() will kfree() the new flow's 'sf_acts' pointer,
but nothing has initialized that pointer.  Initialize the pointer to NULL
to avoid the problem.

Found by inspection.

Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Jesse Gross <jesse@nicira.com>
---

diff --git a/datapath/flow.c b/datapath/flow.c
index f264866a..d670925a 100644
--- a/datapath/flow.c
+++ b/datapath/flow.c
@@ -196,6 +196,7 @@ struct sw_flow *flow_alloc(void)
 
 	spin_lock_init(&flow->lock);
 	atomic_set(&flow->refcnt, 1);
+	flow->sf_acts = NULL;
 	flow->dead = false;
 
 	return flow;