[ovs-dev] [PATCH] datapath: Fix recirc bug where skb is double freed.

Andy Zhou azhou at nicira.com
Mon Aug 25 22:24:09 UTC 2014


If recirc action is the last action of a action list, the SKB triggers
the recirc will be freed twice. This patch fixes this bug.

Reported-by: Justin Pettit <jpettit at nicira.com>
Signed-off-by: Andy Zhou <azhou at nicira.com>
---
 datapath/actions.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/datapath/actions.c b/datapath/actions.c
index d70348e..2bfc527 100644
--- a/datapath/actions.c
+++ b/datapath/actions.c
@@ -897,6 +897,12 @@ static int do_execute_actions(struct datapath *dp, struct sk_buff *skb,
 
 		case OVS_ACTION_ATTR_RECIRC:
 			err = execute_recirc(dp, skb, a, rem);
+			if (last_action(a, rem)) {
+				/* If this is the last action, the skb has
+				 * been consumed or freed.
+				 * Return immediately. */
+				return err;
+			}
 			break;
 
 		case OVS_ACTION_ATTR_SET:
-- 
1.9.1




More information about the dev mailing list