mir/ovs
2
0
Fork 0
mirror of https://github.com/openvswitch/ovs synced 2025-09-04 00:05:15 +00:00
Code Issues Releases Wiki Activity

dpif-netdev: Fix use-after-free in port_unref().

Browse Source 
When the last rxq is closed (which releases the rxq's internal reference
to its netdev) the next call to netdev_n_rxq() accesses freed memory.

Found by valgrind.

Signed-off-by: Ben Pfaff <blp@nicira.com>
Reported-by: Jarno Rajahalme <jrajahalme@nicira.com>
Acked-by: Jarno Rajahalme <jrajahalme@nicira.com>
This commit is contained in:
Ben Pfaff
2014-05-20 17:09:59 -07:00
parent 34a0d77840
commit 87400a3d4c
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
lib/dpif-netdev.c
View File

@@ -811,12 +811,14 @@ static void
port_unref(struct dp_netdev_port *port) port_unref(struct dp_netdev_port *port)
{ {
if (port && ovs_refcount_unref(&port->ref_cnt) == 1) { if (port && ovs_refcount_unref(&port->ref_cnt) == 1) {
int n_rxq;
int i; int i;
netdev_close(port->netdev); netdev_close(port->netdev);
netdev_restore_flags(port->sf); netdev_restore_flags(port->sf);
for (i = 0; i < netdev_n_rxq(port->netdev); i++) { n_rxq = netdev_n_rxq(port->netdev);
for (i = 0; i < n_rxq; i++) {
netdev_rxq_close(port->rxq[i]); netdev_rxq_close(port->rxq[i]);
} }
free(port->type); free(port->type);