When the last rxq is closed (which releases the rxq's internal reference
to its netdev) the next call to netdev_n_rxq() accesses freed memory.
Found by valgrind.
Signed-off-by: Ben Pfaff <blp@nicira.com>
Reported-by: Jarno Rajahalme <jrajahalme@nicira.com>
Acked-by: Jarno Rajahalme <jrajahalme@nicira.com>
port_unref(struct dp_netdev_port *port)
{
if (port && ovs_refcount_unref(&port->ref_cnt) == 1) {
+ int n_rxq;
int i;
netdev_close(port->netdev);
netdev_restore_flags(port->sf);
- for (i = 0; i < netdev_n_rxq(port->netdev); i++) {
+ n_rxq = netdev_n_rxq(port->netdev);
+ for (i = 0; i < n_rxq; i++) {
netdev_rxq_close(port->rxq[i]);
}
free(port->type);