[prev in list] [next in list] [prev in thread] [next in thread] 

List:       openvswitch-discuss
Subject:    [ovs-discuss] ovs-vswitchd segment fault when set controller_rate_limit
From:       wenx05124561 () 163 ! com (wenxu)
Date:       2016-01-26 10:29:37
Message-ID: c9c2f1c.8e3b.1527d7b4703.Coremail.wenx05124561 () 163 ! com
[Download RAW message or body]

Hi all,

I meet a crash problem in openvswitch-2.3.0.
The ovs run pretty well for long time. But I add a packet_in limit setting  \
'ovs-vsctl set controller 60ef551e-6dab-49a6-803b-80b880f6ff1a \
controller_burst_limit=200 controller_rate_limit=200'  the ovs crashed as followed

(gdb) bt
#0  0x000000000047b154 in ofpmsg_update_length (buf=0x2a7b2e0) at lib/ofp-msgs.c:836
#1  0x00000000004b27eb in do_send (vconn=0x1e05a70, msg=0x2a7b2e0) at lib/vconn.c:679
#2  0x00000000004a27fe in try_send (rc=0x1c6b300) at lib/rconn.c:1149
#3  0x00000000004a2dd4 in rconn_send__ (rc=0x1c6b300, b=0x2a7b2e0, counter=0x1c6b5d0) \
at lib/rconn.c:767 #4  0x00000000004a2e8e in rconn_send_with_limit (rc=0x1c6b300, \
b=0x2a7b2e0, counter=0x1c6b5d0, queue_limit=100) at lib/rconn.c:823 #5  \
0x000000000043771b in do_send_packet_ins (ofconn=0x1c6b480, txq=0x7ffff052c700) at \
ofproto/connmgr.c:1756 #6  0x000000000043941b in ofconn_run (mgr=0x1c1ec80, \
handle_openflow=0x41e370 <handle_openflow>) at ofproto/connmgr.c:1387 #7  connmgr_run \
(mgr=0x1c1ec80, handle_openflow=0x41e370 <handle_openflow>) at ofproto/connmgr.c:339 \
#8  0x000000000041aa31 in ofproto_run (p=0x1c0dba0) at ofproto/ofproto.c:1543 #9  \
0x00000000004059dc in bridge_run__ () at vswitchd/bridge.c:2255 #10 \
0x000000000040c967 in bridge_run () at vswitchd/bridge.c:2307 #11 0x000000000040e025 \
in main (argc=11, argv=0x7ffff052cb98) at vswitchd/ovs-vswitchd.c:116

void ofpmsg_update_length(struct ofpbuf *buf)
{
    struct ofp_header *oh = ofpbuf_at_assert(buf, 0, sizeof *oh);
    oh->length = htons(ofpbuf_size(buf)); //crashed on this line
}
 
(gdb) p *buf
$33 = {base_ = 0x20, data_ = 0x51, size_ = 47931072, allocated = 0, frame = 0x0, \
l2_5_ofs = 65535, l3_ofs = 65535, l4_ofs = 65535,  source = OFPBUF_MALLOC, list_node \
= {prev = 0x1c6b360, next = 0x1c6b360}}

I think there is a memory write-overflow problem in controller_rate_limit mode. Is \
there a bug for this?


BR
Xu Wen

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://openvswitch.org/pipermail/discuss/attachments/20160126/86715657/attachment.html>



[prev in list] [next in list] [prev in thread] [next in thread]