diff options
| author | Andy Zhou <azhou@nicira.com> | 2014-07-17 15:17:44 -0700 |
|---|---|---|
| committer | Pravin B Shelar <pshelar@nicira.com> | 2014-07-24 09:37:20 -0700 |
| commit | f53e38317d581399eb67809d6b6b6c2c107db50c (patch) | |
| tree | 2c289fa62e00614a8267cecfac3a9c7703b3aef8 /net | |
| parent | f6eec614d2252a99b861e288b6301599d2d58da4 (diff) | |
openvswitch: Avoid memory corruption in queue_userspace_packet()
In queue_userspace_packet(), the ovs_nla_put_flow return value is
not checked. This is fine as long as key_attr_size() returns the
correct value. In case it does not, the current code may corrupt buffer
memory. Add a run time assertion catch this case to avoid silent
failure.
Reported-by: Ben Pfaff <blp@nicira.com>
Signed-off-by: Andy Zhou <azhou@nicira.com>
Signed-off-by: Pravin B Shelar <pshelar@nicira.com>
Diffstat (limited to 'net')
| -rw-r--r-- | net/openvswitch/datapath.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c index 65a8e5c089e..3c461e1e455 100644 --- a/net/openvswitch/datapath.c +++ b/net/openvswitch/datapath.c @@ -464,7 +464,8 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb, upcall->dp_ifindex = dp_ifindex; nla = nla_nest_start(user_skb, OVS_PACKET_ATTR_KEY); - ovs_nla_put_flow(upcall_info->key, upcall_info->key, user_skb); + err = ovs_nla_put_flow(upcall_info->key, upcall_info->key, user_skb); + BUG_ON(err); nla_nest_end(user_skb, nla); if (upcall_info->userdata) |