[ovs-discuss] ovs-vswitchd segment fault when set controller_rate_limit

wenxu wenx05124561 at 163.com
Tue Jan 26 10:29:37 UTC 2016

Hi all,

I meet a crash problem in openvswitch-2.3.0.
The ovs run pretty well for long time. But I add a packet_in limit setting  'ovs-vsctl set controller 60ef551e-6dab-49a6-803b-80b880f6ff1a controller_burst_limit=200 controller_rate_limit=200'  the ovs crashed as followed

(gdb) bt
#0  0x000000000047b154 in ofpmsg_update_length (buf=0x2a7b2e0) at lib/ofp-msgs.c:836
#1  0x00000000004b27eb in do_send (vconn=0x1e05a70, msg=0x2a7b2e0) at lib/vconn.c:679
#2  0x00000000004a27fe in try_send (rc=0x1c6b300) at lib/rconn.c:1149
#3  0x00000000004a2dd4 in rconn_send__ (rc=0x1c6b300, b=0x2a7b2e0, counter=0x1c6b5d0) at lib/rconn.c:767
#4  0x00000000004a2e8e in rconn_send_with_limit (rc=0x1c6b300, b=0x2a7b2e0, counter=0x1c6b5d0, queue_limit=100) at lib/rconn.c:823
#5  0x000000000043771b in do_send_packet_ins (ofconn=0x1c6b480, txq=0x7ffff052c700) at ofproto/connmgr.c:1756
#6  0x000000000043941b in ofconn_run (mgr=0x1c1ec80, handle_openflow=0x41e370 <handle_openflow>) at ofproto/connmgr.c:1387
#7  connmgr_run (mgr=0x1c1ec80, handle_openflow=0x41e370 <handle_openflow>) at ofproto/connmgr.c:339
#8  0x000000000041aa31 in ofproto_run (p=0x1c0dba0) at ofproto/ofproto.c:1543
#9  0x00000000004059dc in bridge_run__ () at vswitchd/bridge.c:2255
#10 0x000000000040c967 in bridge_run () at vswitchd/bridge.c:2307
#11 0x000000000040e025 in main (argc=11, argv=0x7ffff052cb98) at vswitchd/ovs-vswitchd.c:116

void ofpmsg_update_length(struct ofpbuf *buf)
    struct ofp_header *oh = ofpbuf_at_assert(buf, 0, sizeof *oh);
    oh->length = htons(ofpbuf_size(buf)); //crashed on this line
(gdb) p *buf
$33 = {base_ = 0x20, data_ = 0x51, size_ = 47931072, allocated = 0, frame = 0x0, l2_5_ofs = 65535, l3_ofs = 65535, l4_ofs = 65535,
  source = OFPBUF_MALLOC, list_node = {prev = 0x1c6b360, next = 0x1c6b360}}

I think there is a memory write-overflow problem in controller_rate_limit mode. Is there a bug for this?

Xu Wen
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://openvswitch.org/pipermail/ovs-discuss/attachments/20160126/86715657/attachment-0002.html>

More information about the discuss mailing list