mirror of
https://github.com/openvswitch/ovs
synced 2025-08-31 06:15:47 +00:00
dpif-netdev: Fix another use-after-free in port_unref().
Commit 87400a3d4c
(dpif-netdev: Fix use-after-free in port_unref().)
fixed one use-after-free in the common case of port_unref(). However,
there was another, similar case: if port->netdev has no rxqs, then
the netdev_close() causes port->netdev to be destroyed and thus the
following call to netdev_n_rxq() accesses freed memory. This commit fixes
the problem.
Found by valgrind.
Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Andy Zhou <azhou@nicira.com>
This commit is contained in:
@@ -820,13 +820,12 @@ port_ref(struct dp_netdev_port *port)
|
||||
static void
|
||||
port_destroy__(struct dp_netdev_port *port)
|
||||
{
|
||||
int n_rxq;
|
||||
int n_rxq = netdev_n_rxq(port->netdev);
|
||||
int i;
|
||||
|
||||
netdev_close(port->netdev);
|
||||
netdev_restore_flags(port->sf);
|
||||
|
||||
n_rxq = netdev_n_rxq(port->netdev);
|
||||
for (i = 0; i < n_rxq; i++) {
|
||||
netdev_rxq_close(port->rxq[i]);
|
||||
}
|
||||
|
Reference in New Issue
Block a user