From e019a574fe225cd7b2afebe06627ec2c3d58fc57 Mon Sep 17 00:00:00 2001 From: Ben Pfaff Date: Tue, 13 Aug 2013 17:44:14 -0700 Subject: [PATCH] ofproto-dpif: Destroy bundle after moving its last port out. When the ofp_port argument to bundle_add_port() refers to an ofport_dpif that already belongs to some other bundle, bundle_add_port() removed the port from the other bundle, correctly, with bundle_del_port(). If the other bundle now contained no ports, however, this violated the invariant that a bundle always contains at least one port. Normally, this would get fixed up when the other bundle was processed later during reconfiguration. I haven't quite zeroed in on the exact case where this is not true, but segfaults have happened here in production, in particular when port adds and deletes happen simultaneously and the new port reuses the OpenFlow port number of one of the deleted ports. It seems that the duplicate port number allows some port to rip away the new port from its bundle without destroying that bundle. I suspect, therefore, that there is still a more subtle bug here, but I hope that this will fix the segfault. Bug #18967. Signed-off-by: Ben Pfaff --- ofproto/ofproto-dpif.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ofproto/ofproto-dpif.c b/ofproto/ofproto-dpif.c index 4c5a776df..229b16cc7 100644 --- a/ofproto/ofproto-dpif.c +++ b/ofproto/ofproto-dpif.c @@ -2400,7 +2400,7 @@ bundle_add_port(struct ofbundle *bundle, ofp_port_t ofp_port, if (port->bundle != bundle) { bundle->ofproto->backer->need_revalidate = REV_RECONFIGURE; if (port->bundle) { - bundle_del_port(port); + bundle_remove(&port->up); } port->bundle = bundle; -- 2.20.1