[ovs-dev] [PATCH] ofproto-dpif: fix an ovs crash when dpif_recv_set returns error

Andy Zhou azhou at nicira.com
Mon Aug 4 19:39:06 UTC 2014


I made the change and pushed to master and branch-2.3.
Thanks a lot  for pointing this out!

On Mon, Aug 4, 2014 at 10:54 AM, Ben Pfaff <blp at nicira.com> wrote:
> On Mon, Aug 04, 2014 at 09:47:14AM -0700, Andy Zhou wrote:
>> When dpif_recv_set returns an error, close_dpif_backer gets called,
>> which in term calls recirc_id_pool_destroy, which can lead to a crash
>> since recirc_id_pool_create() was not called before this patch.
>>
>> Reported-by: Mukesh Hira <mhira at vmware.com>
>> Signed-off-by: Andy Zhou <azhou at nicira.com>
>
> Acked-by: Ben Pfaff <blp at nicira.com>
>
> I guess that we can remove this code and comment from
> check_variable_length_userdata() now, since we no longer have recv
> enabled when we call that function:
>
>         /* Variable-length userdata is supported.
>          *
>          * Purge received packets to avoid processing the nonsense packet we
>          * sent to userspace, then report success. */
>         dpif_recv_purge(backer->dpif);



More information about the dev mailing list