[ovs-build] Passed: dceara/ovs#65 (fix-idl-memleak-use-after-free-v2 - b701cfa)

[Travis CI]

Build Update for dceara/ovs
-------------------------------------

Build: #65
Status: Passed

Duration: 19 mins and 33 secs
Commit: b701cfa (fix-idl-memleak-use-after-free-v2)
Author: Dumitru Ceara
Message: ovsdb-idl: Fix use-after-free when deleting orphaned rows.

It's possible that the IDL client processes multiple jsonrpc updates
in a single ovsdb_idl_run().

Considering the following updates processed in a single IDL run:
1. Update row R1 from table A while R1 is also referenced by row R2 from
   table B:
   - this adds R1 to table A's track_list.
2. Delete row R1 from table A while R1 is also referenced by row R2 from
   table B:
   - because row R2 still refers to row R1, this will create an orphan
     R1.
   - at this point R1 is still in table A's hmap.

When the IDL client calls ovsdb_idl_track_clear() after it has finished
processing the tracked changes, row R1 gets freed leaving a dangling
pointer in table A's hmap.

To fix this we don't free rows in ovsdb_idl_track_clear() if they are
orphan and still referenced by other rows, i.e., the row's 'dst_arcs'
list is not empty.  Later, when all arc sources (e.g., R2) are
deleted, the orphan R1 will be cleaned up as well.

The only exception is when the whole contents of the IDL are flushed,
in ovsdb_idl_db_clear(), in which case it's safe to free all rows.

Reported-by: Ilya Maximets <i.maximets at ovn.org>
Fixes: 932104f483ef ("ovsdb-idl: Add support for change tracking.")
Signed-off-by: Dumitru Ceara <dceara at redhat.com>

View the changeset: https://github.com/dceara/ovs/compare/cda22c659e95^...b701cfae10b0

View the full build log and details: https://travis-ci.org/github/dceara/ovs/builds/747235375?utm_medium=notification&utm_source=email


--

You can unsubscribe from build emails from the dceara/ovs repository going to https://travis-ci.org/account/preferences/unsubscribe?repository=25057358&utm_medium=notification&utm_source=email.
Or unsubscribe from *all* email updating your settings at https://travis-ci.org/account/preferences/unsubscribe?utm_medium=notification&utm_source=email.
Or configure specific recipients for build notifications in your .travis.yml file. See https://docs.travis-ci.com/user/notifications.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.openvswitch.org/pipermail/ovs-build/attachments/20201202/bebb288a/attachment.html>