bridge: Avoid use-after-free with VLAN splinters and multiple bridges.
authorBen Pfaff <blp@nicira.com>
Fri, 9 Dec 2011 23:57:55 +0000 (15:57 -0800)
committerBen Pfaff <blp@nicira.com>
Sat, 10 Dec 2011 04:47:27 +0000 (20:47 -0800)
commit7c70698f0134fe1dee756e468a095ddd6366a7d5
treeecba5e43074a891047194f8a19fe50a6db6d24cb
parentd60a2b538a2411019e401a0756c8c0aa1f3b6e98
bridge: Avoid use-after-free with VLAN splinters and multiple bridges.

The VLAN splinters feature uses a "pool" to track and free allocated
blocks.  There's only one pool, but the implementation was freeing all of
the blocks in it for every bridge during reconfiguration, not just once for
each reconfiguration, so caused a use-after-free when there was more than
one bridge and a bridge other than the last one in the list of bridges had
a VLAN splinter port.

Bug #8671.
Reported-by: Michael Mao <mmao@nicira.com>
Signed-off-by: Ben Pfaff <blp@nicira.com>
vswitchd/bridge.c