dpif-netdev: Fix another use-after-free in port_unref().
authorBen Pfaff <blp@nicira.com>
Wed, 4 Jun 2014 22:41:09 +0000 (15:41 -0700)
committerBen Pfaff <blp@nicira.com>
Thu, 5 Jun 2014 18:40:20 +0000 (11:40 -0700)
commit5e5d6d8c1d502614a7482f7be5c8ba7e1654f0f0
tree556f74386428422b122945e4791990f915108597
parent016143f26f3d563e41e02c7a3f9a422d0e8caa9d
dpif-netdev: Fix another use-after-free in port_unref().

Commit 87400a3d4cc4a (dpif-netdev: Fix use-after-free in port_unref().)
fixed one use-after-free in the common case of port_unref().  However,
there was another, similar case: if port->netdev has no rxqs, then
the netdev_close() causes port->netdev to be destroyed and thus the
following call to netdev_n_rxq() accesses freed memory.  This commit fixes
the problem.

Found by valgrind.

Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Andy Zhou <azhou@nicira.com>
lib/dpif-netdev.c