ofproto: Fix use-after-free in bridge destruction with groups.
authorBen Pfaff <blp@nicira.com>
Tue, 23 Jun 2015 18:38:56 +0000 (11:38 -0700)
committerBen Pfaff <blp@nicira.com>
Fri, 26 Jun 2015 15:45:55 +0000 (08:45 -0700)
commit5488d16df5d1e619a9a8fa6e967bd25bb331f6ee
tree1c15a6effc1dd2e6a7d915a9d47838e68f29610d
parent51a903f1f3ef0147711575a3eba9ba26f13d0382
ofproto: Fix use-after-free in bridge destruction with groups.

Groups were not destroyed until after lots of other important bridge
data had been destroyed, including the connection manager.  There was an
indirect dependency on the connection manager for bridge destruction
because destroying a group also destroys all of the flows that reference
the group, which in turn causes the ofmonitor to be invoked to report that
the flows had been destroyed.  This commit fixes the problem by destroying
groups earlier.

The problem can be observed by reverting the code changes in this commit
then running "make check-valgrind" with the test that this commit
introduces.

Reported-by: Simon Horman <simon.horman@netronome.com>
Signed-off-by: Ben Pfaff <blp@nicira.com>
Reviewed-by: Simon Horman <simon.horman@netronome.com>
ofproto/ofproto-dpif.c
ofproto/ofproto-provider.h
ofproto/ofproto.c
tests/ofproto.at