[ovs-dev] [PATCH] dpif-linux: Fix a NULL pointer refernce in vport_del_channels()

[Alex Wang]

Hey Andy,

Thx for the fix.  Could you provide more info on how to reproduce it?
 maybe the backtrace?

I expect vport_del_channels() to be called only when 'port_idx >=
dpif->uc_array_size' or dpif->handlers[0].channels is non-NULL.

I want to know more about the context.

Thx
Alex Wang,


On Sun, Apr 20, 2014 at 11:47 PM, Andy Zhou <azhou at nicira.com> wrote:

> When testing megaflow bond implement I ran into a case where
> dpif->handler[0].channels is NULL. Indexing into channels causes
> vswitchd to crash. Not sure this is the best way to fix it, but
> it worked for me.
>
> Signed-off-by: Andy Zhou <azhou at nicira.com>
> ---
>  lib/dpif-linux.c |    4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/lib/dpif-linux.c b/lib/dpif-linux.c
> index a575b78..9ba6e6a 100644
> --- a/lib/dpif-linux.c
> +++ b/lib/dpif-linux.c
> @@ -441,6 +441,10 @@ vport_del_channels(struct dpif_linux *dpif,
> odp_port_t port_no)
>          return;
>      }
>
> +    if (!dpif->handlers[0].channels) {
> +        return;
> +    }
> +
>      /* Since the sock can only be assigned in either all or none
>       * of "dpif->handlers" channels, the following check would
>       * suffice. */
> --
> 1.7.9.5
>
> _______________________________________________
> dev mailing list
> dev at openvswitch.org
> http://openvswitch.org/mailman/listinfo/dev
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.openvswitch.org/pipermail/ovs-dev/attachments/20140421/5920438a/attachment-0005.html>