From: Benoît Ganne <bganne@cisco.com>
Date: Fri, 17 Apr 2020 10:09:37 +0000 (+0200)
Subject: session: fix use-after-free in input node
X-Git-Tag: v20.09-rc0~182
X-Git-Url: https://gerrit.fd.io/r/gitweb?p=vpp.git;a=commitdiff_plain;h=7ce23f25bbc01d534ca294ce88ab0d709e3e03a7

session: fix use-after-free in input node

Type: fix

Change-Id: Ie60b07abe76ad166f048f5885accd7038d8153b2
Signed-off-by: Benoît Ganne <bganne@cisco.com>
---

diff --git a/src/vnet/session/session_node.c b/src/vnet/session/session_node.c
index 0f5030b4d31..8a96f585499 100644
--- a/src/vnet/session/session_node.c
+++ b/src/vnet/session/session_node.c
@@ -959,6 +959,8 @@ session_tx_fifo_read_and_snd_i (session_worker_t * wrk,
       return SESSION_TX_NO_BUFFERS;
     }
 
+  transport_connection_update_tx_bytes (ctx->tc, ctx->max_len_to_snd);
+
   ctx->left_to_snd = ctx->max_len_to_snd;
   n_left = ctx->n_segs_per_evt;
 
@@ -1032,7 +1034,6 @@ session_tx_fifo_read_and_snd_i (session_worker_t * wrk,
     vlib_buffer_free (vm, wrk->tx_buffers, n_bufs);
 
   *n_tx_packets += ctx->n_segs_per_evt;
-  transport_connection_update_tx_bytes (ctx->tc, ctx->max_len_to_snd);
 
   SESSION_EVT (SESSION_EVT_DEQ, ctx->s, ctx->max_len_to_snd, ctx->max_dequeue,
 	       ctx->s->tx_fifo->has_event, wrk->last_vlib_time);