From: Andy Zhou Date: Thu, 17 Jul 2014 22:17:44 +0000 (-0700) Subject: openvswitch: Avoid memory corruption in queue_userspace_packet() X-Git-Tag: firefly_0821_release~176^2~3474^2~91^2~2 X-Git-Url: http://demsky.eecs.uci.edu/git/?a=commitdiff_plain;h=f53e38317d581399eb67809d6b6b6c2c107db50c;p=firefly-linux-kernel-4.4.55.git openvswitch: Avoid memory corruption in queue_userspace_packet() In queue_userspace_packet(), the ovs_nla_put_flow return value is not checked. This is fine as long as key_attr_size() returns the correct value. In case it does not, the current code may corrupt buffer memory. Add a run time assertion catch this case to avoid silent failure. Reported-by: Ben Pfaff Signed-off-by: Andy Zhou Signed-off-by: Pravin B Shelar --- diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c index 65a8e5c089e4..3c461e1e4554 100644 --- a/net/openvswitch/datapath.c +++ b/net/openvswitch/datapath.c @@ -464,7 +464,8 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb, upcall->dp_ifindex = dp_ifindex; nla = nla_nest_start(user_skb, OVS_PACKET_ATTR_KEY); - ovs_nla_put_flow(upcall_info->key, upcall_info->key, user_skb); + err = ovs_nla_put_flow(upcall_info->key, upcall_info->key, user_skb); + BUG_ON(err); nla_nest_end(user_skb, nla); if (upcall_info->userdata)