[ovs-git] Open vSwitch: flow: Fix hypothetical memory leak in miniflow_move(). (branch-2.0)

dev at openvswitch.org dev at openvswitch.org
Wed Sep 4 20:17:56 UTC 2013


This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "Open vSwitch".

The branch, branch-2.0 has been updated
       via  cd2c51dd9071b2b2a4bae405f576d1ef99667a13 (commit)
       via  3161d84690fe6575210afeb23487a17e8a3a4bbc (commit)
       via  a0b77c6e739fb5db83118fbaea05360021e9d08d (commit)
       via  26062baa94fe8d76b8eb84c83d79effe6d7f99c1 (commit)
       via  52460c160bc617af0537ba5ad966b5006d316d91 (commit)
       via  15720dffed5aa12ae133e8f007c6d4145f6dd919 (commit)
      from  416e09ef5e61fd44b21d82187f167d6690837bba (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit cd2c51dd9071b2b2a4bae405f576d1ef99667a13
Diffs: http://openvswitch.org/cgi-bin/gitweb.cgi?p=openvswitch;a=commitdiff;h=cd2c51dd9071b2b2a4bae405f576d1ef99667a13
Author: Ben Pfaff <blp at nicira.com>
		
flow: Fix hypothetical memory leak in miniflow_move().
		
Ordinarily a miniflow will use its inline_values if its values can fit, but
there is nothing to prevent a small number of values from being stored
in malloc()'d memory.  If this happened, then miniflow_move() would leak
memory.  This commit fixes the problem.

This is a hypothetical problem.  I haven't seen it in practice.

Signed-off-by: Ben Pfaff <blp at nicira.com>
Acked-by: Ethan Jackson <ethan at nicira.com>


commit 3161d84690fe6575210afeb23487a17e8a3a4bbc
Diffs: http://openvswitch.org/cgi-bin/gitweb.cgi?p=openvswitch;a=commitdiff;h=3161d84690fe6575210afeb23487a17e8a3a4bbc
Author: Ben Pfaff <blp at nicira.com>
		
ofproto: Fix memory leak in add_flow().
		
Found by inspection.

Signed-off-by: Ben Pfaff <blp at nicira.com>
Acked-by: Ethan Jackson <ethan at nicira.com>


commit a0b77c6e739fb5db83118fbaea05360021e9d08d
Diffs: http://openvswitch.org/cgi-bin/gitweb.cgi?p=openvswitch;a=commitdiff;h=a0b77c6e739fb5db83118fbaea05360021e9d08d
Author: Ben Pfaff <blp at nicira.com>
		
ofproto-dpif-mirror: Fix memory leak in mbridge_unref().
		
Found by valgrind.

Signed-off-by: Ben Pfaff <blp at nicira.com>
Acked-by: Ethan Jackson <ethan at nicira.com>


commit 26062baa94fe8d76b8eb84c83d79effe6d7f99c1
Diffs: http://openvswitch.org/cgi-bin/gitweb.cgi?p=openvswitch;a=commitdiff;h=26062baa94fe8d76b8eb84c83d79effe6d7f99c1
Author: Ben Pfaff <blp at nicira.com>
		
flow: Fix memory leak in minimask_move().
		
Found by valgrind.

Signed-off-by: Ben Pfaff <blp at nicira.com>
Acked-by: Ethan Jackson <ethan at nicira.com>


commit 52460c160bc617af0537ba5ad966b5006d316d91
Diffs: http://openvswitch.org/cgi-bin/gitweb.cgi?p=openvswitch;a=commitdiff;h=52460c160bc617af0537ba5ad966b5006d316d91
Author: Ben Pfaff <blp at nicira.com>
		
ofproto-dpif: Fix use-after-free deleting a bridge with active traffic.
		
When a bridge that has active traffic is deleted, the bridge's ofproto can
be referenced by in-flight "flow_miss"es.  This commit fixes the problem
by destroying "flow_miss"es that reference the ofproto that is being
deleted.

I found the problem by adding and removing a bridge that had active traffic
(via hping3) while running under valgrind.

Signed-off-by: Ben Pfaff <blp at nicira.com>
Acked-by: Ethan Jackson <ethan at nicira.com>


commit 15720dffed5aa12ae133e8f007c6d4145f6dd919
Diffs: http://openvswitch.org/cgi-bin/gitweb.cgi?p=openvswitch;a=commitdiff;h=15720dffed5aa12ae133e8f007c6d4145f6dd919
Author: Ethan Jackson <ethan at nicira.com>
		
ofproto-dpif: Destroy facets on ofproto removal.
		
Facets maintain a pointer to their owning ofproto-dpif, and therefore
when an ofproto-dpif is destroyed all of their child facets should be
destroyed along with it.  If they aren't, it's possible a subfacet
looked up in the dpif-backer could access it's parent facet and
therefore a defunct parent ofproto causing a segmentation fault.

Bug #19421.
Bug #19423.
Diagnosed-by: Ben Pfaff <blp at nicira.com>
Signed-off-by: Ethan Jackson <ethan at nicira.com>
Signed-off-by: Ben Pfaff <blp at nicira.com>
Acked-by: Ethan Jackson <ethan at nicira.com>


-----------------------------------------------------------------------

Summary of changes:
 lib/flow.c                    |    8 ++++----
 ofproto/ofproto-dpif-mirror.c |    1 +
 ofproto/ofproto-dpif-upcall.c |   31 +++++++++++++++++++++++++++++++
 ofproto/ofproto-dpif-upcall.h |    3 +++
 ofproto/ofproto-dpif.c        |   11 +++++++++++
 ofproto/ofproto.c             |    1 +
 6 files changed, 51 insertions(+), 4 deletions(-)


hooks/post-receive
-- 
Open vSwitch



More information about the git mailing list