diff options
author | 2019-07-19 13:42:12 +0200 | |
---|---|---|
committer | 2019-10-03 16:14:36 +0000 | |
commit | f2c754caa90e8f16aa545cac99ead4bf4437aa44 (patch) | |
tree | 9d301c65c16681fdb59a1f4b7682974e610bfc17 /src/vnet/ip/reass/ip4_full_reass.c | |
parent | bebbd7f62d7f1c0286747d75e11d84bd9d792698 (diff) |
ip: fix use-after-free in reassembly
- ip{4,6}_reass_finalize() frees the reassembly context: do not access
it after the call.
- traces access reassembly context: free it after and not before
tracing.
Type: fix
Change-Id: Ia3aaea9c7b74932e249e013be04b9bd7298fd187
Signed-off-by: Benoît Ganne <bganne@cisco.com>
(cherry picked from commit 2d0ebd7ebc555565868038a09d80a61f5de29430)
Diffstat (limited to 'src/vnet/ip/reass/ip4_full_reass.c')
-rw-r--r-- | src/vnet/ip/reass/ip4_full_reass.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/src/vnet/ip/reass/ip4_full_reass.c b/src/vnet/ip/reass/ip4_full_reass.c index 7cf4f43b0a8..73e820f5427 100644 --- a/src/vnet/ip/reass/ip4_full_reass.c +++ b/src/vnet/ip/reass/ip4_full_reass.c @@ -1040,11 +1040,12 @@ ip4_full_reass_update (vlib_main_t * vm, vlib_node_runtime_t * node, reass->data_len == reass->last_packet_octet + 1) { *handoff_thread_idx = reass->sendout_thread_index; + int handoff = + reass->memory_owner_thread_index != reass->sendout_thread_index; rc = ip4_full_reass_finalize (vm, node, rm, rt, reass, bi0, next0, error0, is_custom_app); - if (IP4_REASS_RC_OK == rc - && reass->memory_owner_thread_index != reass->sendout_thread_index) + if (IP4_REASS_RC_OK == rc && handoff) { rc = IP4_REASS_RC_HANDOFF; } |