ip: reassembly: fix one possible use-after-free 14/28414/1
authorGao Feng <davidfgao@tencent.com>
Sun, 26 Apr 2020 01:57:18 +0000 (09:57 +0800)
committerAndrew Yourtchenko <ayourtch@gmail.com>
Thu, 13 Aug 2020 17:20:47 +0000 (17:20 +0000)
commitbfbbb1855e976c0c1b336fe2b9bea81fac7567a3
treec923d27296426f652f53d17585f9e9c670cfbf31
parentd549129538b65eee8549237ea2aaf7d59d89da2f
ip: reassembly: fix one possible use-after-free

When use the kv->v.memory_owner_thread_index as the index to get the
reass in pool, maybe this element is freed by the owner thread because
of timeout, too many fragments, and so on.

So we should check if do_handoff with kv->v.memory_owner_thread_index
before get the reass from pool.

Type: fix

Signed-off-by: Gao Feng <davidfgao@tencent.com>
Change-Id: Ie0f1dc368f86d0fd65292ca0c5e1908348015e09
(cherry picked from commit 9165e0365cc21575fd3e4a98be59317a839553f4)
src/vnet/ip/reass/ip4_full_reass.c
src/vnet/ip/reass/ip6_full_reass.c