[ovs-git] [openvswitch/ovs] 250e94: ofproto: Fix memory leak and memory exhaustion bug...

[GitHub]

  Branch: refs/heads/branch-2.5
  Home:   https://github.com/openvswitch/ovs
  Commit: 250e947f45e443b61f266307bc95fe986805c05c
      https://github.com/openvswitch/ovs/commit/250e947f45e443b61f266307bc95fe986805c05c
  Author: Ben Pfaff <blp at ovn.org>
  Date:   2016-01-19 (Tue, 19 Jan 2016)

  Changed paths:
    M ofproto/ofproto.c
    M tests/ofproto.at

  Log Message:
  -----------
  ofproto: Fix memory leak and memory exhaustion bugs in group_mod.

In handle_group_mod() cases where adding a group failed, nothing freed the
list of buckets, causing a leak.  The same was true in every case of
modifying a group.  This commit fixes the problem by changing add_group()
to never steal or free the buckets (modify_group() already acted this way)
and then making handle_group_mod() always free the buckets when it's done.

This approach might at first raise objections, because it makes add_group()
copy the buckets instead of just take the existing ones.  But it actually
fixes a worse problem too: when OF1.4+ REQUESTFORWARD is enabled, the
group_mod is reused for the request forwarding.  Until now, for a group_mod
that adds a new group and that has some buckets, the previous stealing of
buckets in add_group() meant that the group_mod's buckets were no longer
valid; in practice, the list of buckets became linked in a way that
iteration never terminated, which caused memory to be exhausted while
composing the requestforward message.  By making add_group() no longer
modify the group_mod, we also fix this problem.

The requestforward test in the testsuite did not find the latter problem
because it only added a group without any buckets.  This commit also
updates the testsuite to include a bucket in its group_mod, which would
have found the problem.

Found by pain and suffering.

Signed-off-by: Ben Pfaff <blp at ovn.org>
Acked-by: Jarno Rajahalme <jarno at ovn.org>