From: Pravin B Shelar <pshelar@nicira.com>
Date: Fri, 17 Oct 2014 22:02:27 +0000 (-0700)
Subject: datapath: fix a use after free
X-Git-Tag: v2.3.1~16
X-Git-Url: http://git.cascardo.eti.br/?p=cascardo%2Fovs.git;a=commitdiff_plain;h=c61ecc0709f2b39c68a681d4a1f8dd1299e199d0

datapath: fix a use after free

pskb_may_pull() called by arphdr_ok can change skb->data, so put the arp
setting after arphdr_ok to avoid the use the freed memory

Fixes: 0714812134d7d ("openvswitch: Eliminate memset() from flow_extract.")
Cc: Jesse Gross <jesse@nicira.com>
Cc: Eric Dumazet <edumazet@google.com>
Signed-off-by: Li RongQing <roy.qing.li@gmail.com>
Acked-by: Jesse Gross <jesse@nicira.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

arphdr_ok() was not done on branch-2.3, so backported whole fix
as part of this patch.

Acked-by: Pravin B Shelar <pshelar@nicira.com>
---

diff --git a/datapath/flow.c b/datapath/flow.c
index ee835d192..e0cb720f9 100644
--- a/datapath/flow.c
+++ b/datapath/flow.c
@@ -539,15 +539,16 @@ static int key_extract(struct sk_buff *skb, struct sw_flow_key *key)
 
 	} else if ((key->eth.type == htons(ETH_P_ARP) ||
 		   key->eth.type == htons(ETH_P_RARP)) && arphdr_ok(skb)) {
+		bool arp_available = arphdr_ok(skb);
 		struct arp_eth_header *arp;
 
 		arp = (struct arp_eth_header *)skb_network_header(skb);
 
-		if (arp->ar_hrd == htons(ARPHRD_ETHER)
-				&& arp->ar_pro == htons(ETH_P_IP)
-				&& arp->ar_hln == ETH_ALEN
-				&& arp->ar_pln == 4) {
-
+		if (arp_available &&
+		    arp->ar_hrd == htons(ARPHRD_ETHER) &&
+		    arp->ar_pro == htons(ETH_P_IP) &&
+		    arp->ar_hln == ETH_ALEN &&
+		    arp->ar_pln == 4) {
 			/* We only match on the lower 8 bits of the opcode. */
 			if (ntohs(arp->ar_op) <= 0xff)
 				key->ip.proto = ntohs(arp->ar_op);