From d6aa7ad6250d17885666c6505d567d06bfc093b2 Mon Sep 17 00:00:00 2001 From: Ethan Jackson Date: Wed, 4 Sep 2013 09:27:31 -0700 Subject: [PATCH] ofproto-dpif: Destroy facets on ofproto removal. Facets maintain a pointer to their owning ofproto-dpif, and therefore when an ofproto-dpif is destroyed all of their child facets should be destroyed along with it. If they aren't, it's possible a subfacet looked up in the dpif-backer could access it's parent facet and therefore a defunct parent ofproto causing a segmentation fault. Bug #19421. Bug #19423. Diagnosed-by: Ben Pfaff Signed-off-by: Ethan Jackson Signed-off-by: Ben Pfaff Acked-by: Ethan Jackson --- ofproto/ofproto-dpif.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/ofproto/ofproto-dpif.c b/ofproto/ofproto-dpif.c index 70a226c43..336453c47 100644 --- a/ofproto/ofproto-dpif.c +++ b/ofproto/ofproto-dpif.c @@ -1421,8 +1421,17 @@ destruct(struct ofproto *ofproto_) struct rule_dpif *rule, *next_rule; struct ofputil_packet_in *pin, *next_pin; struct ofputil_flow_mod *fm, *next_fm; + struct facet *facet, *next_facet; + struct cls_cursor cursor; struct oftable *table; + ovs_rwlock_rdlock(&ofproto->facets.rwlock); + cls_cursor_init(&cursor, &ofproto->facets, NULL); + ovs_rwlock_unlock(&ofproto->facets.rwlock); + CLS_CURSOR_FOR_EACH_SAFE (facet, next_facet, cr, &cursor) { + facet_remove(facet); + } + ofproto->backer->need_revalidate = REV_RECONFIGURE; ovs_rwlock_wrlock(&xlate_rwlock); xlate_remove_ofproto(ofproto); -- 2.20.1