diff options
| author | Ben Pfaff <blp@ovn.org> | 2017-10-27 08:40:23 -0700 |
|---|---|---|
| committer | Ben Pfaff <blp@ovn.org> | 2017-11-02 11:13:24 -0700 |
| commit | d2cb0218d02646f740788e4b01587782fd8ca98f (patch) | |
| tree | 2391eef068a5df8e345f78cef038e01951ba21e5 /ofproto | |
| parent | c19105a09304d8af8cde41f79075f5bdc005bf7d (diff) | |
| download | openvswitch-d2cb0218d02646f740788e4b01587782fd8ca98f.tar.gz | |
ofproto-dpif-upcall: Fix null pointer dereference on exit.
When revalidation occurs at the same time that a bridge is being removed
or ovs-vswitchd is exiting, xlate_lookup_ofproto() races with deletion of
the ofproto. This caused a null pointer dereference if revalidation lost
the race. This commit fixes the problem.
Reported-by: Jakub Sitnicki <jkbs@redhat.com>
Tested-by: Jakub Sitnicki <jkbs@redhat.com>
Signed-off-by: Ben Pfaff <blp@ovn.org>
Diffstat (limited to 'ofproto')
| -rw-r--r-- | ofproto/ofproto-dpif-upcall.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/ofproto/ofproto-dpif-upcall.c b/ofproto/ofproto-dpif-upcall.c index 4a71bbe25..e52871da2 100644 --- a/ofproto/ofproto-dpif-upcall.c +++ b/ofproto/ofproto-dpif-upcall.c @@ -2047,8 +2047,8 @@ revalidate_ukey__(struct udpif *udpif, const struct udpif_key *ukey, if (xoutp->slow) { struct ofproto_dpif *ofproto; ofproto = xlate_lookup_ofproto(udpif->backer, &ctx.flow, NULL); - uint32_t smid = ofproto->up.slowpath_meter_id; - uint32_t cmid = ofproto->up.controller_meter_id; + uint32_t smid = ofproto ? ofproto->up.slowpath_meter_id : UINT32_MAX; + uint32_t cmid = ofproto ? ofproto->up.controller_meter_id : UINT32_MAX; ofpbuf_clear(odp_actions); compose_slow_path(udpif, xoutp, &ctx.flow, ctx.flow.in_port.odp_port, |