ofproto: Fix use after free in ofoperation_complete().
authorEthan Jackson <ethan@nicira.com>
Thu, 7 Jun 2012 20:05:41 +0000 (13:05 -0700)
committerEthan Jackson <ethan@nicira.com>
Thu, 7 Jun 2012 20:09:55 +0000 (13:09 -0700)
In one edge case, ofoperation_complete() destroys its rule, without
updating its ofoperation that the rule is gone.  Later in the same
function, ofoperation_destroy() attempts to modify the rule which
already destroyed.

Bug #11797.
Signed-off-by: Ethan Jackson <ethan@nicira.com>
ofproto/ofproto.c

index 0c24314f9c4a3a14c7a03c45f4b3efd59e69e482..eed0458763d0ad8e7bdd96fca294542bd2e66709 100644 (file)
@@ -3617,6 +3617,7 @@ ofoperation_complete(struct ofoperation *op, enum ofperr error)
         } else {
             oftable_substitute_rule(rule, op->victim);
             ofproto_rule_destroy__(rule);
+            op->rule = NULL;
         }
         break;