mir/openvswitch
2
0
Fork 0
mirror of https://github.com/openvswitch/ovs synced 2025-10-09 13:49:05 +00:00
Code Issues Releases Wiki Activity

dpif-netdev: Fix another use-after-free in port_unref().

Browse Source 
Commit 87400a3d4c (dpif-netdev: Fix use-after-free in port_unref().)
fixed one use-after-free in the common case of port_unref().  However,
there was another, similar case: if port->netdev has no rxqs, then
the netdev_close() causes port->netdev to be destroyed and thus the
following call to netdev_n_rxq() accesses freed memory.  This commit fixes
the problem.

Found by valgrind.

Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Andy Zhou <azhou@nicira.com>
This commit is contained in:
Ben Pfaff
2014-06-04 15:41:09 -07:00
parent 08edf83739
commit 98de6bebb8
1 changed files with 1 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
lib/dpif-netdev.c
View File

@@ -820,13 +820,12 @@ port_ref(struct dp_netdev_port *port)
static void static void
port_destroy__(struct dp_netdev_port *port) port_destroy__(struct dp_netdev_port *port)
{ {
int n_rxq; int n_rxq = netdev_n_rxq(port->netdev);
int i; int i;
netdev_close(port->netdev); netdev_close(port->netdev);
netdev_restore_flags(port->sf); netdev_restore_flags(port->sf);
n_rxq = netdev_n_rxq(port->netdev);
for (i = 0; i < n_rxq; i++) { for (i = 0; i < n_rxq; i++) {
netdev_rxq_close(port->rxq[i]); netdev_rxq_close(port->rxq[i]);
} }