[ovs-dev] [PATCH] dpif-netdev: Fix a race.

Ben Pfaff blp at nicira.com
Wed Nov 26 00:02:43 UTC 2014


On Tue, Nov 25, 2014 at 04:01:40PM -0800, Alex Wang wrote:
> On current master, the 'struct dp_netdev_port' is destroyed
> immediately when the ref count reaches 0.  However, non-pmd
> threads calling the dpif_netdev_execute() for sending packets
> could hold pointer to 'port' that is not ref-counted.  Thusly
> those threads could possibly access freed memory when the port
> is deleted.
> 
> To fix this bug, this commit makes non-pmd threads acquiring
> the 'port_mutex' before doing the actual execution in
> dpif_netdev_execute().
> 
> Signed-off-by: Alex Wang <alexw at nicira.com>

I don't know this code well enough to review it, but I hope that
there's a proper lock ordering discipline so that this fix doesn't
introduce a deadlock?

Thanks,

Ben.



More information about the dev mailing list