dpif-netdev: Fix a race.
authorAlex Wang <alexw@nicira.com>
Tue, 25 Nov 2014 23:51:12 +0000 (15:51 -0800)
committerAlex Wang <alexw@nicira.com>
Mon, 1 Dec 2014 18:53:19 +0000 (10:53 -0800)
commit433330a8bfaf38b41bbe3c482c57562202ba1e61
tree8eb7d7d58243108f68c8296386b86bd42788e3e4
parentd14c1c5152f41f1984c614dc1e7824ae8cea94b1
dpif-netdev: Fix a race.

On current master, the 'struct dp_netdev_port' is destroyed
immediately when the ref count reaches 0.  However, non-pmd
threads calling the dpif_netdev_execute() for sending packets
could hold pointer to 'port' that is not ref-counted.  Thusly
those threads could possibly access freed memory when the port
is deleted.

To fix this bug, this commit makes non-pmd threads acquiring
the 'port_mutex' before doing the actual execution in
dpif_netdev_execute().

Signed-off-by: Alex Wang <alexw@nicira.com>
Acked-by: Pravin B Shelar <pshelar@nicira.com>
lib/dpif-netdev.c