2
0
mirror of https://github.com/openvswitch/ovs synced 2025-08-31 06:15:47 +00:00

dpif-netdev: Fix another use-after-free in port_unref().

Commit 87400a3d4c (dpif-netdev: Fix use-after-free in port_unref().)
fixed one use-after-free in the common case of port_unref().  However,
there was another, similar case: if port->netdev has no rxqs, then
the netdev_close() causes port->netdev to be destroyed and thus the
following call to netdev_n_rxq() accesses freed memory.  This commit fixes
the problem.

Found by valgrind.

Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Andy Zhou <azhou@nicira.com>
This commit is contained in:
Ben Pfaff
2014-06-04 15:41:09 -07:00
parent 08edf83739
commit 98de6bebb8

View File

@@ -820,13 +820,12 @@ port_ref(struct dp_netdev_port *port)
static void
port_destroy__(struct dp_netdev_port *port)
{
int n_rxq;
int n_rxq = netdev_n_rxq(port->netdev);
int i;
netdev_close(port->netdev);
netdev_restore_flags(port->sf);
n_rxq = netdev_n_rxq(port->netdev);
for (i = 0; i < n_rxq; i++) {
netdev_rxq_close(port->rxq[i]);
}