<div dir="ltr">Acked-by: Joe Stringer &lt;<a href="mailto:joestringer@nicira.com">joestringer@nicira.com</a>&gt;</div><div class="gmail_extra"><br><br><div class="gmail_quote">On 16 May 2014 10:36, Ben Pfaff <span dir="ltr">&lt;<a href="mailto:blp@nicira.com" target="_blank">blp@nicira.com</a>&gt;</span> wrote:<br>

<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">The loop in revalidate() needs to ensure that any data obtained from<br>
dpif_flow_dump_next() is used before it is destroyed, as indicated by<br>
dpif_flow_dump_next_may_destroy_keys().  In the common case, where<br>
processing reaches the end of the main &quot;while&quot; loop, it does this, but<br>
in two corner cases the code in the loop execute &quot;continue;&quot;, which skipped<br>
the check.  This commit fixes the problem.<br>
<br>
Bug #1249988.<br>
Signed-off-by: Ben Pfaff &lt;<a href="mailto:blp@nicira.com">blp@nicira.com</a>&gt;<br>
---<br>
 ofproto/ofproto-dpif-upcall.c |    5 +++--<br>
 1 file changed, 3 insertions(+), 2 deletions(-)<br>
<br>
diff --git a/ofproto/ofproto-dpif-upcall.c b/ofproto/ofproto-dpif-upcall.c<br>
index e1117ba..f15e916 100644<br>
--- a/ofproto/ofproto-dpif-upcall.c<br>
+++ b/ofproto/ofproto-dpif-upcall.c<br>
@@ -1470,7 +1470,7 @@ revalidate(struct revalidator *revalidator)<br>
                  * flow this time. */<br>
                 ovs_mutex_unlock(&amp;ukey-&gt;mutex);<br>
                 COVERAGE_INC(upcall_duplicate_flow);<br>
-                continue;<br>
+                goto next;<br>
             }<br>
<br>
             used = ukey-&gt;created;<br>
@@ -1493,7 +1493,7 @@ revalidate(struct revalidator *revalidator)<br>
                      * another revalidator is processing this flow<br>
                      * concurrently, so don&#39;t bother processing it. */<br>
                     ukey_delete(NULL, ukey);<br>
-                    continue;<br>
+                    goto next;<br>
                 }<br>
             }<br>
<br>
@@ -1511,6 +1511,7 @@ revalidate(struct revalidator *revalidator)<br>
             dump_op_init(&amp;ops[n_ops++], key, key_len, ukey);<br>
         }<br>
<br>
+    next:<br>
         may_destroy = dpif_flow_dump_next_may_destroy_keys(&amp;udpif-&gt;dump,<br>
                                                            state);<br>
<span class="HOEnZb"><font color="#888888"><br>
--<br>
1.7.10.4<br>
<br>
_______________________________________________<br>
dev mailing list<br>
<a href="mailto:dev@openvswitch.org">dev@openvswitch.org</a><br>
<a href="http://openvswitch.org/mailman/listinfo/dev" target="_blank">http://openvswitch.org/mailman/listinfo/dev</a><br>
</font></span></blockquote></div><br></div>