[ovs-build] Passed: williamtu/ovs-travis#424 (yifeng-tun - 52284c3)

[Travis CI]

Build Update for williamtu/ovs-travis
-------------------------------------

Build: #424
Status: Passed

Duration: 54 mins and 38 secs
Commit: 52284c3 (yifeng-tun)
Author: Yifeng Sun
Message: tun_metadata: Fix coredump caused by use-after-free bug

Tun_metadata can be referened by flow and frozen_state at the same
time. When ovs-vswitchd handles TLV table mod message, the involved
tun_metadata gets freed. The call trace to free tun_metadata is
shown as below:

ofproto_run
- handle_openflow
  - handle_single_part_openflow
    - handle_tlv_table_mod
      - tun_metadata_table_mod
        - tun_metadata_postpone_free

Unfortunately, this tun_metadata can be still used by some frozen_state,
and later on when frozen_state tries to access its tun_metadata table,
ovs-vswitchd crashes. The call trace to access tun_metadata from
frozen_state is shown as below:

udpif_upcall_handler
- recv_upcalls
  - process_upcall
    - frozen_metadata_to_flow

This patch fixes it by introducing a reference count to tun_metadata.
Whenever a pointer of tun_metadata is passed between flow and
frozen_state, we increase its reference count. Reference count
is decreased at deallocation.

In present code, pointer of tun_metadata can be passed between flows.
It is safe because of RCU mechanism.

VMware-BZ: #2526222
Signed-off-by: Yifeng Sun <pkusunyifeng at gmail.com>
Signed-off-by: William Tu <u9012063 at gmail.com>

View the changeset: https://github.com/williamtu/ovs-travis/commit/52284c34df49

View the full build log and details: https://travis-ci.org/github/williamtu/ovs-travis/builds/667765333?utm_medium=notification&utm_source=email

--

You can unsubscribe from build emails from the williamtu/ovs-travis repository going to https://travis-ci.org/account/preferences/unsubscribe?repository=6871381&utm_medium=notification&utm_source=email.
Or unsubscribe from *all* email updating your settings at https://travis-ci.org/account/preferences/unsubscribe?utm_medium=notification&utm_source=email.
Or configure specific recipients for build notifications in your .travis.yml file. See https://docs.travis-ci.com/user/notifications.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.openvswitch.org/pipermail/ovs-build/attachments/20200327/9096f3cc/attachment.html>