swofp_flow_timeout() use after free

[Jonathan Gray]

swofp_flow_entry_delete -> swofp_flow_entry_free -> free(swfe)

Index: switchofp.c
===================================================================
RCS file: /cvs/src/sys/net/switchofp.c,v
retrieving revision 1.16
diff -u -p -U10 -r1.16 switchofp.c
--- switchofp.c 23 Oct 2016 11:56:51 -0000      1.16
+++ switchofp.c 27 Oct 2016 06:02:54 -0000
@@ -1489,20 +1489,21 @@ swofp_flow_timeout(struct switch_softc *
        TAILQ_FOREACH(swft, &ofs->swofs_table_list, swft_table_next) {
                LIST_FOREACH_SAFE(swfe, &swft->swft_flow_list,
                    swfe_next, tswfe) {
                        if (swfe->swfe_idle_timeout) {
                                timespecsub(&now, &swfe->swfe_idle_time, &idle);
                                if (swfe->swfe_idle_timeout < idle.tv_sec) {
                                        VDPRINTF(sc, "flow(id:%d) expired "
                                            "by idle timeout\n", swfe->swfe_id);
                                        swofp_flow_entry_delete(sc, swft, swfe,
                                            OFP_FLOWREM_REASON_IDLE_TIMEOUT);
+                                       continue;
                                }
                        }
                        if (swfe->swfe_hard_timeout) {
                                timespecsub(&now, &swfe->swfe_installed_time,
                                    &duration);
                                if (swfe->swfe_hard_timeout < duration.tv_sec) {
                                        VDPRINTF(sc, "flow(id:%d) expired "
                                            "by hard timeout\n", swfe->swfe_id);
                                        swofp_flow_entry_delete(sc, swft, swfe,
                                            OFP_FLOWREM_REASON_HARD_TIMEOUT);