diff options
| author | Alex Wang <alexw@nicira.com> | 2014-11-25 15:51:12 -0800 |
|---|---|---|
| committer | Alex Wang <alexw@nicira.com> | 2014-12-01 10:53:19 -0800 |
| commit | 433330a8bfaf38b41bbe3c482c57562202ba1e61 (patch) | |
| tree | 8eb7d7d58243108f68c8296386b86bd42788e3e4 /lib/dpif-netdev.c | |
| parent | d14c1c5152f41f1984c614dc1e7824ae8cea94b1 (diff) | |
| download | openvswitch-433330a8bfaf38b41bbe3c482c57562202ba1e61.tar.gz | |
dpif-netdev: Fix a race.
On current master, the 'struct dp_netdev_port' is destroyed
immediately when the ref count reaches 0. However, non-pmd
threads calling the dpif_netdev_execute() for sending packets
could hold pointer to 'port' that is not ref-counted. Thusly
those threads could possibly access freed memory when the port
is deleted.
To fix this bug, this commit makes non-pmd threads acquiring
the 'port_mutex' before doing the actual execution in
dpif_netdev_execute().
Signed-off-by: Alex Wang <alexw@nicira.com>
Acked-by: Pravin B Shelar <pshelar@nicira.com>
Diffstat (limited to 'lib/dpif-netdev.c')
| -rw-r--r-- | lib/dpif-netdev.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/lib/dpif-netdev.c b/lib/dpif-netdev.c index ea8702397..52331301e 100644 --- a/lib/dpif-netdev.c +++ b/lib/dpif-netdev.c @@ -2029,10 +2029,12 @@ dpif_netdev_execute(struct dpif *dpif, struct dpif_execute *execute) * the 'non_pmd_mutex'. */ if (pmd->core_id == NON_PMD_CORE_ID) { ovs_mutex_lock(&dp->non_pmd_mutex); + ovs_mutex_lock(&dp->port_mutex); } dp_netdev_execute_actions(pmd, &pp, 1, false, execute->actions, execute->actions_len); if (pmd->core_id == NON_PMD_CORE_ID) { + ovs_mutex_unlock(&dp->port_mutex); ovs_mutex_unlock(&dp->non_pmd_mutex); } |