[ovs-dev] [PATCH] bridge: fix crash when more than 32767 ports added

Ben Pfaff blp at ovn.org
Wed Apr 4 17:27:08 UTC 2018

On Thu, Mar 29, 2018 at 10:33:56AM +0800, lidejun1 at huawei.com wrote:
> From: l00397770 <lidejun1 at huawei.com>
> When creating a port using ovs-vsctl, its Openflow port number is automatically
> assigned, and the max value is 32767. After adding 32767 ports, subsequent ports'
> number are all 65535, and they are all inserted into a bridge's ifaces hmap,
> but when these ports are deleted, their hamp_nodes are not removed by iface_destroy__,
> this can cause ovs crash in the following call path:
> bridge_reconfigure ---> bridge_add_ports ---> bridge_add_ports__ ---> iface_create
> ---> hmap_insert_at ---> hmap_expand_at ---> resize ---> hmap_insert_fast,
> the bridge's ifaces hmap bucket is corrupted.
> To fix the above issue, we check Openflow port number in iface_do_create: if the port
> number is 65535, report an error and do not add this port into a bridge.
> Signed-off-by: lidejun1 at huawei.com
> Acked-By: jerry.lilijun at huawei.com

Thank you for the bug fix.

This adds a new check to the caller of ofproto_port_add().  That
function is documented to set the ofp_port argument to OFPP_NONE only if
there is an error.  The caller already checks for an error return.
Therefore, it sounds like there is a bug in ofproto_port_add() that can
cause it to set the port to OFPP_NONE even without reporting an error.
Would you mind trying to find and fix the error in ofproto_port_add(),
instead of covering it up in the caller?



More information about the dev mailing list