Fix double-free: NF_HOOK sometimes frees the sk_buff passed in.

[sliver-openvswitch.git] / datapath / datapath.c

diff --git a/datapath/datapath.c b/datapath/datapath.c
index e9d51a8..4f5acd0 100644 (file)
--- a/datapath/datapath.c
+++ b/datapath/datapath.c
@@ -466,7 +466,6 @@ do_port_input(struct net_bridge_port *p, struct sk_buff *skb)
 #ifdef SUPPORT_SNAT
        /* Check if this packet needs early SNAT processing. */
        if (snat_pre_route(skb)) {
-               kfree_skb(skb);
                return;
        }
 #endif
@@ -670,7 +669,6 @@ dp_output_control(struct datapath *dp, struct sk_buff *skb,
         * forward the whole packet? */
        struct sk_buff *f_skb;
        struct ofp_packet_in *opi;
-       struct net_bridge_port *p;
        size_t fwd_len, opi_len;
        int err;
 
@@ -686,11 +684,12 @@ dp_output_control(struct datapath *dp, struct sk_buff *skb,
        }
        opi->buffer_id      = htonl(buffer_id);
        opi->total_len      = htons(skb->len);
-       p = skb->dev->br_port;
-       opi->in_port        = htons(p ? p->port_no : OFPP_LOCAL);
+       opi->in_port        = htons(skb->dev && skb->dev->br_port
+                                   ? skb->dev->br_port->port_no
+                                   : OFPP_LOCAL);
        opi->reason         = reason;
        opi->pad            = 0;
-       memcpy(opi->data, skb_mac_header(skb), fwd_len);
+       skb_copy_bits(skb, 0, opi->data, fwd_len);
        err = send_openflow_skb(f_skb, NULL);
 
 out:
@@ -1176,13 +1175,11 @@ static int dp_genl_query(struct sk_buff *skb, struct genl_info *info)
 
                genlmsg_end(ans_skb, data);
                err = genlmsg_reply(ans_skb, info);
-               if (!err)
-                       ans_skb = NULL;
+               ans_skb = NULL;
        }
 err:
 nla_put_failure:
-       if (ans_skb)
-               kfree_skb(ans_skb);
+       kfree_skb(ans_skb);
        rcu_read_unlock();
        return err;
 }