ofproto: Fix order of destruction in ofproto_destroy().

ofproto_flush_flows() calls into the connmgr (via connmgr_flushed()) so
it must be called before destroying the connmgr to avoid a use-after-free
error.

Bug #5231.
Reported-by: Krishna Miriyala <krishna@nicira.com>

diff --git a/ofproto/ofproto.c b/ofproto/ofproto.c
index 6994b11..7cdc98a 100644 (file)
--- a/ofproto/ofproto.c
+++ b/ofproto/ofproto.c
@@ -683,10 +683,8 @@ ofproto_destroy(struct ofproto *p)
 
     shash_find_and_delete(&all_ofprotos, dpif_name(p->dpif));
 
-    /* Destroy connmgr early, since it touches the classifier. */
-    connmgr_destroy(p->connmgr);
-
     ofproto_flush_flows(p);
+    connmgr_destroy(p->connmgr);
     classifier_destroy(&p->cls);
     hmap_destroy(&p->facets);