[ovs-dev] [PATCH monitor_cond V14 1/2] ovsdb: Fix reference to table's row on condition_add|remove_clause

Liran Schour lirans at il.ibm.com
Tue Aug 16 06:06:58 UTC 2016


Use struct uuid * on [add|remove]_clause on columns which are references to
tables. That prevents use-after-free errors.

Signed-off-by: Liran Schour <lirans at il.ibm.com>
---
 ovsdb/ovsdb-idlc.in    | 40 ++++++++++++++++++++--------------------
 python/ovs/db/types.py | 13 ++++++++++---
 2 files changed, 30 insertions(+), 23 deletions(-)

diff --git a/ovsdb/ovsdb-idlc.in b/ovsdb/ovsdb-idlc.in
index 487876b..fc574b4 100755
--- a/ovsdb/ovsdb-idlc.in
+++ b/ovsdb/ovsdb-idlc.in
@@ -28,7 +28,7 @@ def constify(cType, const):
     else:
         return cType
 
-def cMembers(prefix, tableName, columnName, column, const):
+def cMembers(prefix, tableName, columnName, column, const, refTable=True):
     comment = ""
     type = column.type
 
@@ -63,10 +63,10 @@ def cMembers(prefix, tableName, columnName, column, const):
         valueName = "value_%s" % columnName
 
         key = {'name': keyName,
-               'type': constify(type.key.toCType(prefix) + pointer, const),
+               'type': constify(type.key.toCType(prefix, refTable) + pointer, const),
                'comment': ''}
         value = {'name': valueName,
-                 'type': constify(type.value.toCType(prefix) + pointer, const),
+                 'type': constify(type.value.toCType(prefix, refTable) + pointer, const),
                  'comment': ''}
 
         if singleton:
@@ -78,7 +78,7 @@ def cMembers(prefix, tableName, columnName, column, const):
         members = [key, value]
     else:
         m = {'name': columnName,
-             'type': constify(type.key.toCType(prefix) + pointer, const),
+             'type': constify(type.key.toCType(prefix, refTable) + pointer, const),
              'comment': type.cDeclComment()}
 
         if singleton:
@@ -245,7 +245,7 @@ bool %(s)s_is_updated(const struct %(s)s *, enum %(s)s_column_id);
                 args = ['const struct smap *']
             else:
                 comment, members = cMembers(prefix, tableName, columnName,
-                                            column, True)
+                                            column, True, refTable=False)
                 args = ['%(type)s%(name)s' % member for member in members]
             print '%s);' % ', '.join(args)
 
@@ -259,7 +259,7 @@ bool %(s)s_is_updated(const struct %(s)s *, enum %(s)s_column_id);
                 args = ['const struct smap *']
             else:
                 comment, members = cMembers(prefix, tableName, columnName,
-                                            column, True)
+                                            column, True, refTable=False)
                 args = ['%(type)s%(name)s' % member for member in members]
             print '%s);' % ', '.join(args)
 
@@ -923,7 +923,7 @@ void
             type = column.type
 
             comment, members = cMembers(prefix, tableName, columnName,
-                                        column, True)
+                                        column, True, refTable=False)
 
             if type.is_smap():
                 print comment
@@ -994,10 +994,10 @@ void
                 print "    ovs_assert(inited);"
                 print "    datum.n = 1;"
                 print "    datum.keys = &key;"
-                print "    " + type.key.assign_c_value_casting_away_const("key.%s" % type.key.type.to_string(), keyVar)
+                print "    " + type.key.assign_c_value_casting_away_const("key.%s" % type.key.type.to_string(), keyVar, refTable=False)
                 if type.value:
                     print "    datum.values = &value;"
-                    print "    "+ type.value.assign_c_value_casting_away_const("value.%s" % type.value.type.to_string(), valueVar)
+                    print "    "+ type.value.assign_c_value_casting_away_const("value.%s" % type.value.type.to_string(), valueVar, refTable=False)
                 else:
                     print "    datum.values = NULL;"
             elif type.is_optional_pointer():
@@ -1007,7 +1007,7 @@ void
                 print "    if (%s) {" % keyVar
                 print "        datum.n = 1;"
                 print "        datum.keys = &key;"
-                print "        " + type.key.assign_c_value_casting_away_const("key.%s" % type.key.type.to_string(), keyVar)
+                print "        " + type.key.assign_c_value_casting_away_const("key.%s" % type.key.type.to_string(), keyVar, refTable=False)
                 print "    } else {"
                 print "        datum.n = 0;"
                 print "        datum.keys = NULL;"
@@ -1020,7 +1020,7 @@ void
                 print "    if (%s) {" % nVar
                 print "        datum.n = 1;"
                 print "        datum.keys = &key;"
-                print "        " + type.key.assign_c_value_casting_away_const("key.%s" % type.key.type.to_string(), "*" + keyVar)
+                print "        " + type.key.assign_c_value_casting_away_const("key.%s" % type.key.type.to_string(), "*" + keyVar, refTable=False)
                 print "    } else {"
                 print "        datum.n = 0;"
                 print "        datum.keys = NULL;"
@@ -1037,9 +1037,9 @@ void
                 else:
                     print "    datum.values = NULL;"
                 print "    for (i = 0; i < %s; i++) {" % nVar
-                print "        " + type.key.copyCValue("datum.keys[i].%s" % type.key.type.to_string(), "%s[i]" % keyVar)
+                print "        " + type.key.copyCValue("datum.keys[i].%s" % type.key.type.to_string(), "%s[i]" % keyVar, refTable=False)
                 if type.value:
-                    print "        " + type.value.copyCValue("datum.values[i].%s" % type.value.type.to_string(), "%s[i]" % valueVar)
+                    print "        " + type.value.copyCValue("datum.values[i].%s" % type.value.type.to_string(), "%s[i]" % valueVar, refTable=False)
                 print "    }"
                 if type.value:
                     valueType = type.value.toAtomicType()
@@ -1090,7 +1090,7 @@ void
             type = column.type
 
             comment, members = cMembers(prefix, tableName, columnName,
-                                        column, True)
+                                        column, True, refTable=False)
 
             if type.is_smap():
                 print comment
@@ -1160,10 +1160,10 @@ void
                 print "    ovs_assert(inited);"
                 print "    datum.n = 1;"
                 print "    datum.keys = &key;"
-                print "    " + type.key.assign_c_value_casting_away_const("key.%s" % type.key.type.to_string(), keyVar)
+                print "    " + type.key.assign_c_value_casting_away_const("key.%s" % type.key.type.to_string(), keyVar, refTable=False)
                 if type.value:
                     print "    datum.values = &value;"
-                    print "    "+ type.value.assign_c_value_casting_away_const("value.%s" % type.value.type.to_string(), valueVar)
+                    print "    "+ type.value.assign_c_value_casting_away_const("value.%s" % type.value.type.to_string(), valueVar, refTable=False)
                 else:
                     print "    datum.values = NULL;"
             elif type.is_optional_pointer():
@@ -1173,7 +1173,7 @@ void
                 print "    if (%s) {" % keyVar
                 print "        datum.n = 1;"
                 print "        datum.keys = &key;"
-                print "        " + type.key.assign_c_value_casting_away_const("key.%s" % type.key.type.to_string(), keyVar)
+                print "        " + type.key.assign_c_value_casting_away_const("key.%s" % type.key.type.to_string(), keyVar, refTable=False)
                 print "    } else {"
                 print "        datum.n = 0;"
                 print "        datum.keys = NULL;"
@@ -1186,7 +1186,7 @@ void
                 print "    if (%s) {" % nVar
                 print "        datum.n = 1;"
                 print "        datum.keys = &key;"
-                print "        " + type.key.assign_c_value_casting_away_const("key.%s" % type.key.type.to_string(), "*" + keyVar)
+                print "        " + type.key.assign_c_value_casting_away_const("key.%s" % type.key.type.to_string(), "*" + keyVar, refTable=False)
                 print "    } else {"
                 print "        datum.n = 0;"
                 print "        datum.keys = NULL;"
@@ -1203,9 +1203,9 @@ void
                 else:
                     print "    datum.values = NULL;"
                 print "    for (i = 0; i < %s; i++) {" % nVar
-                print "        " + type.key.copyCValue("datum.keys[i].%s" % type.key.type.to_string(), "%s[i]" % keyVar)
+                print "        " + type.key.copyCValue("datum.keys[i].%s" % type.key.type.to_string(), "%s[i]" % keyVar, refTable=False)
                 if type.value:
-                    print "        " + type.value.copyCValue("datum.values[i].%s" % type.value.type.to_string(), "%s[i]" % valueVar)
+                    print "        " + type.value.copyCValue("datum.values[i].%s" % type.value.type.to_string(), "%s[i]" % valueVar, refTable=False)
                 print "    }"
                 if type.value:
                     valueType = type.value.toAtomicType()
diff --git a/python/ovs/db/types.py b/python/ovs/db/types.py
index 944372e..a87c83c 100644
--- a/python/ovs/db/types.py
+++ b/python/ovs/db/types.py
@@ -339,8 +339,11 @@ class BaseType(object):
 
         return english
 
-    def toCType(self, prefix):
+    def toCType(self, prefix, refTable=True):
         if self.ref_table_name:
+            if not refTable:
+                assert self.type == UuidType
+                return 'struct uuid *'
             return "struct %s%s *" % (prefix, self.ref_table_name.lower())
         else:
             return {IntegerType: 'int64_t ',
@@ -352,18 +355,22 @@ class BaseType(object):
     def toAtomicType(self):
         return "OVSDB_TYPE_%s" % self.type.to_string().upper()
 
-    def copyCValue(self, dst, src):
+    def copyCValue(self, dst, src, refTable=True):
         args = {'dst': dst, 'src': src}
         if self.ref_table_name:
+            if not refTable:
+                return "%(dst)s = *%(src)s;" % args
             return ("%(dst)s = %(src)s->header_.uuid;") % args
         elif self.type == StringType:
             return "%(dst)s = xstrdup(%(src)s);" % args
         else:
             return "%(dst)s = %(src)s;" % args
 
-    def assign_c_value_casting_away_const(self, dst, src):
+    def assign_c_value_casting_away_const(self, dst, src, refTable=True):
         args = {'dst': dst, 'src': src}
         if self.ref_table_name:
+            if not refTable:
+                return "%(dst)s = *%(src)s;" % args
             return ("%(dst)s = %(src)s->header_.uuid;") % args
         elif self.type == StringType:
             return "%(dst)s = CONST_CAST(char *, %(src)s);" % args
-- 
2.1.4




More information about the dev mailing list