ofproto-dpif: Fix use-after-free deleting a bridge with active traffic.
authorBen Pfaff <blp@nicira.com>
Wed, 4 Sep 2013 19:38:12 +0000 (12:38 -0700)
committerBen Pfaff <blp@nicira.com>
Wed, 4 Sep 2013 20:09:37 +0000 (13:09 -0700)
commit52460c160bc617af0537ba5ad966b5006d316d91
tree535e11ec51842e03da340f5f88cd25a4058f3ba1
parent15720dffed5aa12ae133e8f007c6d4145f6dd919
ofproto-dpif: Fix use-after-free deleting a bridge with active traffic.

When a bridge that has active traffic is deleted, the bridge's ofproto can
be referenced by in-flight "flow_miss"es.  This commit fixes the problem
by destroying "flow_miss"es that reference the ofproto that is being
deleted.

I found the problem by adding and removing a bridge that had active traffic
(via hping3) while running under valgrind.

Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Ethan Jackson <ethan@nicira.com>
ofproto/ofproto-dpif-upcall.c
ofproto/ofproto-dpif-upcall.h
ofproto/ofproto-dpif.c