dpif-netdev: Fix another use-after-free in port_unref().
authorBen Pfaff <blp@nicira.com>
Wed, 4 Jun 2014 22:41:09 +0000 (15:41 -0700)
committerBen Pfaff <blp@nicira.com>
Thu, 5 Jun 2014 18:35:32 +0000 (11:35 -0700)
commit98de6bebb8339057ec4e012e670eb952a4b8e00f
tree4bebff02ca9ef570b1f10fc1de20539be2f9451c
parent08edf837392da295c7769c3e6759250ca0fe849c
dpif-netdev: Fix another use-after-free in port_unref().

Commit 87400a3d4cc4a (dpif-netdev: Fix use-after-free in port_unref().)
fixed one use-after-free in the common case of port_unref().  However,
there was another, similar case: if port->netdev has no rxqs, then
the netdev_close() causes port->netdev to be destroyed and thus the
following call to netdev_n_rxq() accesses freed memory.  This commit fixes
the problem.

Found by valgrind.

Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Andy Zhou <azhou@nicira.com>
lib/dpif-netdev.c