ligang/vpp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ip: fix use-after-free in IPv6 SLAAC expiration

Browse Source 
Type: fix

Change-Id: I46b166b3a10c4543eafa4422531dd3c725db45f1
Signed-off-by: Benoît Ganne <bganne@cisco.com>
(cherry picked from commit 79c9d3650357fa675df2998e362e9881cff17a34)
This commit is contained in:
Benoît Ganne
2019-09-30 10:55:33 +02:00
committed by Andrew Yourtchenko
parent 7efa9c5342
commit b022d3195a
1 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/vnet/ip/rd_cp.c
View File

@ -440,9 +440,15 @@ rd_cp_process (vlib_main_t * vm, vlib_node_runtime_t * rt, vlib_frame_t * f)
do do
{ {
due_time = current_time + 1e9; due_time = current_time + 1e9;
u32 index;
/*
* we do not use pool_foreach() to iterate over pool elements here
* as we are removing elements inside the loop body
*/
/* *INDENT-OFF* */ /* *INDENT-OFF* */
pool_foreach (slaac_address, rm->slaac_address_pool, pool_foreach_index (index, rm->slaac_address_pool,
({ ({
slaac_address = pool_elt_at_index(rm->slaac_address_pool, index);
if (slaac_address->due_time > current_time) if (slaac_address->due_time > current_time)
{ {
if (slaac_address->due_time < due_time) if (slaac_address->due_time < due_time)
@ -450,13 +456,15 @@ rd_cp_process (vlib_main_t * vm, vlib_node_runtime_t * rt, vlib_frame_t * f)
} }
else else
{ {
u32 sw_if_index = slaac_address->sw_if_index;
remove_slaac_address (vm, slaac_address); remove_slaac_address (vm, slaac_address);
/* make sure ip6 stays enabled */ /* make sure ip6 stays enabled */
ip6_enable (slaac_address->sw_if_index); ip6_enable (sw_if_index);
} }
})); }));
pool_foreach (default_route, rm->default_route_pool, pool_foreach_index (index, rm->default_route_pool,
({ ({
default_route = pool_elt_at_index(rm->default_route_pool, index);
if (default_route->due_time > current_time) if (default_route->due_time > current_time)
{ {
if (default_route->due_time < due_time) if (default_route->due_time < due_time)