[ovs-dev] [PATCH/RFC] connmgr: clear ofproto's pointer to connmgr when the latter is destroyed

[Simon Horman]

On Tue, Jun 23, 2015 at 11:39:45AM -0700, Ben Pfaff wrote:
> On Wed, Jun 17, 2015 at 02:22:32PM +0900, Simon Horman wrote:
> > As per the testcase included in this patch it has been observed
> > that ovs-vswtichd may segfault when deleting a bridge.
> > 
> > Analysing the output of valgrind and gdb it appears that
> > this is caused by the connmgr of a ofproto being accessed
> > after the latter has been freed.
> > 
> > It appears that this is occurring in different threads and
> > is the result of the following postponement arrangement in ofproto_destroy();
> > 
> >     /* We should not postpone this because it involves deleting a listening
> >      * socket which we may want to reopen soon. 'connmgr' should not be used
> >      * by other threads */
> >     connmgr_destroy(p->connmgr);
> > 
> >     /* Destroying rules is deferred, must have 'ofproto' around for them. */
> >     ovsrcu_postpone(ofproto_destroy__, p);
> 
> Thanks a lot for the report and the fix.  I found what I think is a
> cleaner fix:
>         http://openvswitch.org/pipermail/dev/2015-June/056716.html
> 
> Will you review it?  Thanks!

Thanks, I have done so.