ofp-actions: Fix use-after-free in bundle action.

[cascardo/ovs.git] / lib / rstp-state-machines.c

diff --git a/lib/rstp-state-machines.c b/lib/rstp-state-machines.c
index d254ca3..9768e46 100644 (file)
--- a/lib/rstp-state-machines.c
+++ b/lib/rstp-state-machines.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2014 M3S, Srl - Italy
+ * Copyright (c) 2011-2015 M3S, Srl - Italy
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -21,6 +21,7 @@
  * Authors:
  *         Martino Fornasa <mf@fornasa.it>
  *         Daniele Venturino <daniele.venturino@m3s.it>
+ *         Carlo Andreotti <c.andreotti@m3s.it>
  *
  * References to IEEE 802.1D-2004 standard are enclosed in square brackets.
  * E.g. [17.3], [Table 17-1], etc.
@@ -696,11 +697,11 @@ rstp_send_bpdu(struct rstp_port *p, const void *bpdu, size_t bpdu_size)
     pkt = dp_packet_new(ETH_HEADER_LEN + LLC_HEADER_LEN + bpdu_size);
     eth = dp_packet_put_zeros(pkt, sizeof *eth);
     llc = dp_packet_put_zeros(pkt, sizeof *llc);
-    dp_packet_set_frame(pkt, eth);
+    dp_packet_reset_offsets(pkt);
     dp_packet_set_l3(pkt, dp_packet_put(pkt, bpdu, bpdu_size));
 
     /* 802.2 header. */
-    memcpy(eth->eth_dst, eth_addr_stp, ETH_ADDR_LEN);
+    eth->eth_dst = eth_addr_stp;
     /* p->rstp->send_bpdu() must fill in source address. */
     eth->eth_type = htons(dp_packet_size(pkt) - ETH_HEADER_LEN);
 
@@ -1858,7 +1859,6 @@ port_role_transition_sm(struct rstp_port *p)
                  p->port_role_transition_sm_state);
     }
     if (last_role != p->role) {
-        last_role = p->role;
         VLOG_DBG("%s, port %u, port role ["RSTP_PORT_ID_FMT"] = %s",
                  p->rstp->name, p->port_number, p->port_id,
                  rstp_port_role_name(p->role));