ofproto: Fix use after free in ofoperation_complete().

In one edge case, ofoperation_complete() destroys its rule, without
updating its ofoperation that the rule is gone.  Later in the same
function, ofoperation_destroy() attempts to modify the rule which
already destroyed.

Bug #11797.
Signed-off-by: Ethan Jackson <ethan@nicira.com>

1 files changed, 1 insertions, 0 deletions

diff --git a/ofproto/ofproto.c b/ofproto/ofproto.c
index 85509e7af..829271fbc 100644
--- a/ofproto/ofproto.c
+++ b/ofproto/ofproto.c
@@ -3212,6 +3212,7 @@ ofoperation_complete(struct ofoperation *op, int error)
                 classifier_remove(table, &rule->cr);
             }
             ofproto_rule_destroy__(rule);
+            op->rule = NULL;
         }
         op->victim = NULL;
         break;