summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorBenoît Ganne <bganne@cisco.com>2019-09-09 16:34:54 +0200
committerNeale Ranns <nranns@cisco.com>2019-09-30 17:08:22 +0000
commit8133c780a22480496c74a4ead321e8350d5beeb4 (patch)
treee64ff73fe1eff5af98c7805b528882e208cf6264
parent5c828bc1f24fb5222d6bb634d8e5228ed8b138f0 (diff)
ipsec: fix use-after-free
When deleting interface from the API, 'hi' gets removed before 'h->sw_if_index' is copied. Type: fix Change-Id: I8e10108e9bdf95ab2fe002790d98262d583ca58c Signed-off-by: Benoît Ganne <bganne@cisco.com>
-rw-r--r--src/vnet/ipsec/ipsec_if.c10
1 files changed, 7 insertions, 3 deletions
diff --git a/src/vnet/ipsec/ipsec_if.c b/src/vnet/ipsec/ipsec_if.c
index f7f8ec79323..a7372747797 100644
--- a/src/vnet/ipsec/ipsec_if.c
+++ b/src/vnet/ipsec/ipsec_if.c
@@ -268,12 +268,13 @@ ipsec_tunnel_feature_set (ipsec_main_t * im, ipsec_tunnel_if_t * t, u8 enable)
int
ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm,
ipsec_add_del_tunnel_args_t * args,
- u32 * sw_if_index)
+ u32 * sw_if_index_p)
{
ipsec_tunnel_if_t *t;
ipsec_main_t *im = &ipsec_main;
vnet_hw_interface_t *hi = NULL;
u32 hw_if_index = ~0;
+ u32 sw_if_index = ~0;
uword *p;
u32 dev_instance;
ipsec_key_t crypto_key, integ_key;
@@ -385,6 +386,7 @@ ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm,
t - im->tunnel_interfaces);
hi = vnet_get_hw_interface (vnm, hw_if_index);
+ sw_if_index = hi->sw_if_index;
t->hw_if_index = hw_if_index;
t->sw_if_index = hi->sw_if_index;
@@ -420,6 +422,8 @@ ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm,
ti = p[0];
t = pool_elt_at_index (im->tunnel_interfaces, ti);
hi = vnet_get_hw_interface (vnm, t->hw_if_index);
+ sw_if_index = hi->sw_if_index;
+
vnet_sw_interface_set_flags (vnm, hi->sw_if_index, 0); /* admin down */
ipsec_tunnel_feature_set (im, t, 0);
@@ -440,8 +444,8 @@ ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm,
pool_put (im->tunnel_interfaces, t);
}
- if (sw_if_index)
- *sw_if_index = hi->sw_if_index;
+ if (sw_if_index_p)
+ *sw_if_index_p = sw_if_index;
return 0;
}