[ovs-dev] [PATCH] datapath: Fix double free when ovs_nla_copy_actions() fails

[Pravin Shelar]

On Tue, Sep 23, 2014 at 10:59 AM, Thomas Graf <tgraf at noironetworks.com> wrote:
> ovs_nla_copy_actions() already frees the allocated actions buffers,
> ovs_flow_cmd_new() will free it a second time when jumping to
> err_kfree_acts.
>
> Signed-off-by: Thomas Graf <tgraf at noironetworks.com>

Pushed to master.

Thanks.
> ---
>  datapath/datapath.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/datapath/datapath.c b/datapath/datapath.c
> index 9850130..170e8ea 100644
> --- a/datapath/datapath.c
> +++ b/datapath/datapath.c
> @@ -888,7 +888,7 @@ static int ovs_flow_cmd_new(struct sk_buff *skb, struct genl_info *info)
>                                      &acts);
>         if (error) {
>                 OVS_NLERR("Flow actions may not be safe on all matching packets.\n");
> -               goto err_kfree_acts;
> +               goto err_kfree_flow;
>         }
>
>         reply = ovs_flow_cmd_alloc_info(acts, info, false);
> --
> 1.9.3
>