When dummy_allocate_flow_mark() fails and returns INVALID_FLOW_MARK,
the code jumps to exit_unlock with off_flow still set to NULL.
At exit_unlock, off_flow->stats is dereferenced if put->stats is
non-NULL, causing a null pointer dereference.
Fix by also checking that no error occurred before accessing
off_flow->stats, since off_flow is guaranteed to be non-NULL
on the success path.
Fixes: e86d368c6e16 ("dummy-offload: Add simulated hardware offload.")
Reported by Coverity: CID 561159.
Signed-off-by: Eelco Chaudron <[email protected]>
---
lib/dpif-offload-dummy.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/dpif-offload-dummy.c b/lib/dpif-offload-dummy.c
index cc9fc5792..878276a94 100644
--- a/lib/dpif-offload-dummy.c
+++ b/lib/dpif-offload-dummy.c
@@ -889,7 +889,7 @@ dummy_flow_put(const struct dpif_offload *offload_, struct
netdev *netdev,
}
exit_unlock:
- if (put->stats) {
+ if (put->stats && !error) {
*put->stats = off_flow->stats;
}
--
2.54.0
_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
