[ovs-dev] [PATCH] ofproto-dpif-upcall: Fix null pointer dereference on exit.

Ben Pfaff blp at ovn.org
Fri Oct 27 15:40:23 UTC 2017


When revalidation occurs at the same time that a bridge is being removed
or ovs-vswitchd is exiting, xlate_lookup_ofproto() races with deletion of
the ofproto.  This caused a null pointer dereference if revalidation lost
the race.  This commit fixes the problem.

Reported-by: Jakub Sitnicki <jkbs at redhat.com>
Signed-off-by: Ben Pfaff <blp at ovn.org>
---
 ofproto/ofproto-dpif-upcall.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/ofproto/ofproto-dpif-upcall.c b/ofproto/ofproto-dpif-upcall.c
index 4a71bbe258df..e52871da2b81 100644
--- a/ofproto/ofproto-dpif-upcall.c
+++ b/ofproto/ofproto-dpif-upcall.c
@@ -2047,8 +2047,8 @@ revalidate_ukey__(struct udpif *udpif, const struct udpif_key *ukey,
     if (xoutp->slow) {
         struct ofproto_dpif *ofproto;
         ofproto = xlate_lookup_ofproto(udpif->backer, &ctx.flow, NULL);
-        uint32_t smid = ofproto->up.slowpath_meter_id;
-        uint32_t cmid = ofproto->up.controller_meter_id;
+        uint32_t smid = ofproto ? ofproto->up.slowpath_meter_id : UINT32_MAX;
+        uint32_t cmid = ofproto ? ofproto->up.controller_meter_id : UINT32_MAX;
 
         ofpbuf_clear(odp_actions);
         compose_slow_path(udpif, xoutp, &ctx.flow, ctx.flow.in_port.odp_port,
-- 
2.10.2



More information about the dev mailing list