diff options
| author | Andy Zhou <azhou@nicira.com> | 2014-08-03 16:16:40 -0700 |
|---|---|---|
| committer | Andy Zhou <azhou@nicira.com> | 2014-08-04 12:37:23 -0700 |
| commit | 9bcefb956d8f712eded13e40e27e55f885c362f2 (patch) | |
| tree | 490eeaeb343fc8ae864062849d47a81988e7343d | |
| parent | edff57a8b0b3c33351e6bbd8746313eaee8cd20c (diff) | |
| download | openvswitch-9bcefb956d8f712eded13e40e27e55f885c362f2.tar.gz | |
ofproto-dpif: fix an ovs crash when dpif_recv_set returns error
When dpif_recv_set returns an error, close_dpif_backer gets called,
which in term calls recirc_id_pool_destroy, which can lead to a crash
since recirc_id_pool_create() was not called before this patch.
Reported-by: Mukesh Hira <mhira@vmware.com>
Signed-off-by: Andy Zhou <azhou@nicira.com>
Acked-by: Ben Pfaff <blp@nicira.com>
| -rw-r--r-- | ofproto/ofproto-dpif.c | 14 |
1 files changed, 5 insertions, 9 deletions
diff --git a/ofproto/ofproto-dpif.c b/ofproto/ofproto-dpif.c index d6fdd477a..d26aaf78c 100644 --- a/ofproto/ofproto-dpif.c +++ b/ofproto/ofproto-dpif.c @@ -917,6 +917,11 @@ open_dpif_backer(const char *type, struct dpif_backer **backerp) shash_add(&all_dpif_backers, type, backer); + backer->enable_recirc = check_recirc(backer); + backer->variable_length_userdata = check_variable_length_userdata(backer); + backer->max_mpls_depth = check_max_mpls_depth(backer); + backer->rid_pool = recirc_id_pool_create(); + error = dpif_recv_set(backer->dpif, backer->recv_set_enable); if (error) { VLOG_ERR("failed to listen on datapath of type %s: %s", @@ -924,10 +929,6 @@ open_dpif_backer(const char *type, struct dpif_backer **backerp) close_dpif_backer(backer); return error; } - backer->enable_recirc = check_recirc(backer); - backer->variable_length_userdata = check_variable_length_userdata(backer); - backer->max_mpls_depth = check_max_mpls_depth(backer); - backer->rid_pool = recirc_id_pool_create(); if (backer->recv_set_enable) { udpif_set_threads(backer->udpif, n_handlers, n_revalidators); @@ -1043,11 +1044,6 @@ check_variable_length_userdata(struct dpif_backer *backer) switch (error) { case 0: - /* Variable-length userdata is supported. - * - * Purge received packets to avoid processing the nonsense packet we - * sent to userspace, then report success. */ - dpif_recv_purge(backer->dpif); return true; case ERANGE: |