diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2019-04-02 09:53:14 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2019-04-02 20:56:21 +0300 |
| commit | 6d670497e01803b486aa72cc1a718401ab986896 (patch) | |
| tree | b6c04cf9dbf218980ee7c25b16dd0449e817e77c /net/openvswitch/conntrack.c | |
| parent | f0dfecc93a60d6ac2acae886103ee0449a25a9c9 (diff) | |
| download | linux-6d670497e01803b486aa72cc1a718401ab986896.tar.xz | |
openvswitch: use after free in __ovs_ct_free_action()
We free "ct_info->ct" and then use it on the next line when we pass it
to nf_ct_destroy_timeout(). This patch swaps the order to avoid the use
after free.
Fixes: 06bd2bdf19d2 ("openvswitch: Add timeout support to ct action")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Yi-Hung Wei <yihung.wei@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/openvswitch/conntrack.c')
| -rw-r--r-- | net/openvswitch/conntrack.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c index 121b01d4a3c0..0be3ab5bde26 100644 --- a/net/openvswitch/conntrack.c +++ b/net/openvswitch/conntrack.c @@ -1804,9 +1804,9 @@ static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info) if (ct_info->helper) nf_conntrack_helper_put(ct_info->helper); if (ct_info->ct) { - nf_ct_tmpl_free(ct_info->ct); if (ct_info->timeout[0]) nf_ct_destroy_timeout(ct_info->ct); + nf_ct_tmpl_free(ct_info->ct); } } |