[ovs-dev] [PATCH] dpif-netdev: Fix a race.

[Alex Wang]

On current master, the 'struct dp_netdev_port' is destroyed
immediately when the ref count reaches 0.  However, non-pmd
threads calling the dpif_netdev_execute() for sending packets
could hold pointer to 'port' that is not ref-counted.  Thusly
those threads could possibly access freed memory when the port
is deleted.

To fix this bug, this commit makes non-pmd threads acquiring
the 'port_mutex' before doing the actual execution in
dpif_netdev_execute().

Signed-off-by: Alex Wang <alexw at nicira.com>
---
 lib/dpif-netdev.c |    2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/dpif-netdev.c b/lib/dpif-netdev.c
index ea87023..5233130 100644
--- a/lib/dpif-netdev.c
+++ b/lib/dpif-netdev.c
@@ -2029,10 +2029,12 @@ dpif_netdev_execute(struct dpif *dpif, struct dpif_execute *execute)
      * the 'non_pmd_mutex'. */
     if (pmd->core_id == NON_PMD_CORE_ID) {
         ovs_mutex_lock(&dp->non_pmd_mutex);
+        ovs_mutex_lock(&dp->port_mutex);
     }
     dp_netdev_execute_actions(pmd, &pp, 1, false, execute->actions,
                               execute->actions_len);
     if (pmd->core_id == NON_PMD_CORE_ID) {
+        ovs_mutex_unlock(&dp->port_mutex);
         ovs_mutex_unlock(&dp->non_pmd_mutex);
     }
 
-- 
1.7.9.5