bridge: Avoid use-after-free with VLAN splinters and multiple bridges.
authorBen Pfaff <blp@nicira.com>
Fri, 9 Dec 2011 23:57:55 +0000 (15:57 -0800)
committerBen Pfaff <blp@nicira.com>
Sat, 10 Dec 2011 04:48:12 +0000 (20:48 -0800)
commitf0c6a3bac90269560182969c05840af795e51991
tree79ab98523577a59060b8369fe60733df8f18be3a
parent9d98d5a9e4f5f2aaa32205422df35e5203baa6a9
bridge: Avoid use-after-free with VLAN splinters and multiple bridges.

The VLAN splinters feature uses a "pool" to track and free allocated
blocks.  There's only one pool, but the implementation was freeing all of
the blocks in it for every bridge during reconfiguration, not just once for
each reconfiguration, so caused a use-after-free when there was more than
one bridge and a bridge other than the last one in the list of bridges had
a VLAN splinter port.

Bug #8671.
Reported-by: Michael Mao <mmao@nicira.com>
Signed-off-by: Ben Pfaff <blp@nicira.com>
vswitchd/bridge.c