* [PATCH net-next v4 07/11] openvswitch: Avoid memory corruption in queue_userspace_packet()
@ 2014-07-17 0:18 Pravin B Shelar
0 siblings, 0 replies; only message in thread
From: Pravin B Shelar @ 2014-07-17 0:18 UTC (permalink / raw)
To: davem; +Cc: netdev, Andy Zhou, Pravin B Shelar
From: Andy Zhou <azhou@nicira.com>
In queue_userspace_packet(), the ovs_nla_put_flow return value is
not checked. This is fine as long as key_attr_size() returns the
correct value. In case it does not, the current code may corrupt buffer
memory. Add a run time assertion catch this case to avoid silent
failure.
Reported-by: Ben Pfaff <blp@nicira.com>
Signed-off-by: Andy Zhou <azhou@nicira.com>
Signed-off-by: Pravin B Shelar <pshelar@nicira.com>
---
net/openvswitch/datapath.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index 995dfa1..de7d4db 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -481,7 +481,8 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb,
upcall->dp_ifindex = dp_ifindex;
nla = nla_nest_start(user_skb, OVS_PACKET_ATTR_KEY);
- ovs_nla_put_flow(upcall_info->key, upcall_info->key, user_skb);
+ err = ovs_nla_put_flow(upcall_info->key, upcall_info->key, user_skb);
+ BUG_ON(err);
nla_nest_end(user_skb, nla);
if (upcall_info->userdata)
--
1.9.3
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2014-07-17 0:19 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2014-07-17 0:18 [PATCH net-next v4 07/11] openvswitch: Avoid memory corruption in queue_userspace_packet() Pravin B Shelar
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.