ligang/vpp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

nat: fix use-after-free

Browse Source 
Type: fix

Change-Id: Iac91c086c4e975f0bada058f40b7b7d4475377f8
Signed-off-by: Benoît Ganne <bganne@cisco.com>
(cherry picked from commit 7233846ce93fddef495a1029ca211f42afe046f2)
This commit is contained in:
Benoît Ganne 2019-07-18 17:33:42 +02:00 committed by Andrew Yourtchenko
parent d294b98c1d
commit 7efa9c5342
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/plugins/nat/nat_inlines.h
View File

@ -172,8 +172,12 @@ nat44_delete_session (snat_main_t * sm, snat_session_t * ses,
snat_main_per_thread_data_t *tsm = vec_elt_at_index (sm->per_thread_data,
thread_index);
clib_bihash_kv_8_8_t kv, value;
snat_user_key_t u_key;
snat_user_t *u;
const snat_user_key_t u_key = {
.addr = ses->in2out.addr,
.fib_index = ses->in2out.fib_index
};
const u8 u_static = snat_is_session_static (ses);
clib_dlist_remove (tsm->list_pool, ses->per_user_index);
pool_put_index (tsm->list_pool, ses->per_user_index);
@ -181,13 +185,11 @@ nat44_delete_session (snat_main_t * sm, snat_session_t * ses,
vlib_set_simple_counter (&sm->total_sessions, thread_index, 0,
pool_elts (tsm->sessions));
u_key.addr = ses->in2out.addr;
u_key.fib_index = ses->in2out.fib_index;
kv.key = u_key.as_u64;
if (!clib_bihash_search_8_8 (&tsm->user_hash, &kv, &value))
{
u = pool_elt_at_index (tsm->users, value.value);
if (snat_is_session_static (ses))
if (u_static)
u->nstaticsessions--;
else
u->nsessions--;