ofproto-dpif: Fix use-after-free deleting a bridge with active traffic.
authorBen Pfaff <blp@nicira.com>
Wed, 4 Sep 2013 19:38:12 +0000 (12:38 -0700)
committerBen Pfaff <blp@nicira.com>
Wed, 4 Sep 2013 19:59:21 +0000 (12:59 -0700)
commit1fe409d57f8f701278a709c608381d2dc1f71cfc
tree93c4da9edc98679f1cd53995a2a9f1a4768a8ab5
parentd6aa7ad6250d17885666c6505d567d06bfc093b2
ofproto-dpif: Fix use-after-free deleting a bridge with active traffic.

When a bridge that has active traffic is deleted, the bridge's ofproto can
be referenced by in-flight "flow_miss"es.  This commit fixes the problem
by destroying "flow_miss"es that reference the ofproto that is being
deleted.

I found the problem by adding and removing a bridge that had active traffic
(via hping3) while running under valgrind.

Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Ethan Jackson <ethan@nicira.com>
ofproto/ofproto-dpif-upcall.c
ofproto/ofproto-dpif-upcall.h
ofproto/ofproto-dpif.c