diff options
| author | Ben Pfaff <blp@nicira.com> | 2013-09-04 12:38:12 -0700 |
|---|---|---|
| committer | Ben Pfaff <blp@nicira.com> | 2013-09-04 12:59:21 -0700 |
| commit | 1fe409d57f8f701278a709c608381d2dc1f71cfc (patch) | |
| tree | 93c4da9edc98679f1cd53995a2a9f1a4768a8ab5 /ofproto/ofproto-dpif-upcall.h | |
| parent | d6aa7ad6250d17885666c6505d567d06bfc093b2 (diff) | |
| download | openvswitch-1fe409d57f8f701278a709c608381d2dc1f71cfc.tar.gz | |
ofproto-dpif: Fix use-after-free deleting a bridge with active traffic.
When a bridge that has active traffic is deleted, the bridge's ofproto can
be referenced by in-flight "flow_miss"es. This commit fixes the problem
by destroying "flow_miss"es that reference the ofproto that is being
deleted.
I found the problem by adding and removing a bridge that had active traffic
(via hping3) while running under valgrind.
Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Ethan Jackson <ethan@nicira.com>
Diffstat (limited to 'ofproto/ofproto-dpif-upcall.h')
| -rw-r--r-- | ofproto/ofproto-dpif-upcall.h | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/ofproto/ofproto-dpif-upcall.h b/ofproto/ofproto-dpif-upcall.h index f597672b9..8e8264e2e 100644 --- a/ofproto/ofproto-dpif-upcall.h +++ b/ofproto/ofproto-dpif-upcall.h @@ -109,6 +109,9 @@ struct flow_miss_batch { struct flow_miss_batch *flow_miss_batch_next(struct udpif *); void flow_miss_batch_destroy(struct flow_miss_batch *); + +void flow_miss_batch_ofproto_destroyed(struct udpif *, + const struct ofproto_dpif *); /* Drop keys are odp flow keys which have drop flows installed in the kernel. * These are datapath flows which have no associated ofproto, if they did we |