openvswitch: Fix a double free bug for the sample action
authorAndy Zhou <azhou@nicira.com>
Wed, 7 May 2014 00:23:48 +0000 (17:23 -0700)
committerPravin B Shelar <pshelar@nicira.com>
Sun, 29 Jun 2014 21:10:43 +0000 (14:10 -0700)
When sample action returns with an error, the skb has already been
freed. This patch fix a bug to make sure we don't free it again.
This bug introduced by commit ccb1352e76cff05 (net: Add Open vSwitch
kernel components.)

Signed-off-by: Andy Zhou <azhou@nicira.com>
Signed-off-by: Pravin B Shelar <pshelar@nicira.com>
net/openvswitch/actions.c

index c36856a457ca963c735e89e36478a53ba60bb453..e70d8b18e96290af1435ef8423c9d71e5496df2d 100644 (file)
@@ -551,6 +551,8 @@ static int do_execute_actions(struct datapath *dp, struct sk_buff *skb,
 
                case OVS_ACTION_ATTR_SAMPLE:
                        err = sample(dp, skb, a);
+                       if (unlikely(err)) /* skb already freed. */
+                               return err;
                        break;
                }