[prev in list] [next in list] [prev in thread] [next in thread] 

List:       openvswitch-dev
Subject:    [ovs-dev] [PATCH] ofproto: Fix use-after-free in bridge destruction with groups.
From:       jrajahalme () nicira ! com (Jarno Rajahalme)
Date:       2015-06-29 10:18:45
Message-ID: 08C7F11B-60F8-4CBC-A0C1-C8FC39A27C95 () nicira ! com
[Download RAW message or body]


> On Jun 26, 2015, at 8:54 AM, Ben Pfaff <blp at nicira.com> wrote:
> 
> On Thu, Jun 25, 2015 at 12:48:27PM +0900, Simon Horman wrote:
> > Hi Ben,
> > 
> > On Tue, Jun 23, 2015 at 11:38:56AM -0700, Ben Pfaff wrote:
> > > Groups were not destroyed until after lots of other important bridge
> > > data had been destroyed, including the connection manager.  There was an
> > > indirect dependency on the connection manager for bridge destruction
> > > because destroying a group also destroys all of the flows that reference
> > > the group, which in turn causes the ofmonitor to be invoked to report that
> > > the flows had been destroyed.  This commit fixes the problem by destroying
> > > groups earlier.
> > > 
> > > The problem can be observed by reverting the code changes in this commit
> > > then running "make check-valgrind" with the test that this commit
> > > introduces.
> > > 
> > > Reported-by: Simon Horman <simon.horman at netronome.com>
> > > Signed-off-by: Ben Pfaff <blp at nicira.com>
> > 
> > Thanks for following up on this; your patch looks good to me.
> > 
> > Reviewed-by: Simon Horman <simon.horman at netronome.com>
> 
> Thanks Simon, I applied this to master and branch-2.4.  I don't know
> whether branch-2.3 has the problem, but the patch doesn't apply cleanly
> and valgrind doesn't report an error with the test on that branch.

I did not look into this, but it would not be surprising for the branch-2.3 not to \
have the problem, as ofproto.c has been refactored twice since 2.3.

  Jarno

> _______________________________________________
> dev mailing list
> dev at openvswitch.org
> http://openvswitch.org/mailman/listinfo/dev


[prev in list] [next in list] [prev in thread] [next in thread]