[ovs-git] [openvswitch/ovs] 777836: netdev-dummy: fix crash with more than one passive...
GitHub
noreply at github.com
Fri Jul 22 22:16:58 UTC 2016
Branch: refs/heads/master
Home: https://github.com/openvswitch/ovs
Commit: 7778360b0bc6a6bf551da1eff5957662e9feb848
https://github.com/openvswitch/ovs/commit/7778360b0bc6a6bf551da1eff5957662e9feb848
Author: Lance Richardson <lrichard at redhat.com>
Date: 2016-07-22 (Fri, 22 Jul 2016)
Changed paths:
M lib/netdev-dummy.c
Log Message:
-----------
netdev-dummy: fix crash with more than one passive connection
Investigation found that Some of the occasional failures in the
"ovn -- vtep: 3 HVs, 1 VIFs/HV, 1 GW, 1 LS" test case are caused
by ovs-vswitchd crashing with SIGSEGV. It turns out that the
crash occurrs when the number of netdev-dummy passive connections
transitions from 1 to 2. When xrealloc() copies the array of
dummy_packet_stream structures from the original buffer to a
newly allocated one, the struct ovs_list txq member of the structure
becomes corrupt (e.g. if ovs_list_is_empty() would have returned
false before the copy, it will return true after the copy, which
will lead to a crash when the bogus packet buffer on the list is
dereferenced).
Fix by taking a hint from David Wheeler and adding a level of
indirection.
Signed-off-by: Lance Richardson <lrichard at redhat.com>
[blp at ovn.org folded in an additional bug fix]
Signed-off-by: Ben Pfaff <blp at ovn.org>
More information about the git
mailing list