[ovs-git] [openvswitch/ovs] 777836: netdev-dummy: fix crash with more than one passive...

GitHub noreply at github.com
Fri Jul 22 22:16:58 UTC 2016


  Branch: refs/heads/master
  Home:   https://github.com/openvswitch/ovs
  Commit: 7778360b0bc6a6bf551da1eff5957662e9feb848
      https://github.com/openvswitch/ovs/commit/7778360b0bc6a6bf551da1eff5957662e9feb848
  Author: Lance Richardson <lrichard at redhat.com>
  Date:   2016-07-22 (Fri, 22 Jul 2016)

  Changed paths:
    M lib/netdev-dummy.c

  Log Message:
  -----------
  netdev-dummy: fix crash with more than one passive connection

Investigation found that Some of the occasional failures in the
"ovn -- vtep: 3 HVs, 1 VIFs/HV, 1 GW, 1 LS" test case are caused
by ovs-vswitchd crashing with SIGSEGV. It turns out that the
crash occurrs when the number of netdev-dummy passive connections
transitions from 1 to 2.  When xrealloc() copies the array of
dummy_packet_stream structures from the original buffer to a
newly allocated one, the struct ovs_list txq member of the structure
becomes corrupt (e.g. if ovs_list_is_empty() would have returned
false before the copy, it will return true after the copy, which
will lead to a crash when the bogus packet buffer on the list is
dereferenced).

Fix by taking a hint from David Wheeler and adding a level of
indirection.

Signed-off-by: Lance Richardson <lrichard at redhat.com>
[blp at ovn.org folded in an additional bug fix]
Signed-off-by: Ben Pfaff <blp at ovn.org>




More information about the git mailing list