[ovs-git] [ovn-org/ovn] 6f5206: binding: Fix the crashes seen when port binding ty...

numansiddique noreply at github.com
Thu Apr 1 18:26:15 UTC 2021

  Branch: refs/heads/branch-21.03
  Home:   https://github.com/ovn-org/ovn
  Commit: 6f520603043f21d84b5ab6874b37f410f4f59ae3
  Author: Numan Siddique <numans at ovn.org>
  Date:   2021-04-01 (Thu, 01 Apr 2021)

  Changed paths:
    M controller/binding.c
    M controller/binding.h
    M controller/ovn-controller.c
    M controller/physical.c
    M tests/ovn-controller.at
    M tests/ovn.at

  Log Message:
  binding: Fix the crashes seen when port binding type changes.

When a port binding type changes from type 'A' to type 'B', then
there are many code paths in the existing binding.c which results
in crashes due to use-after-free or NULL references.

Below crashes are seen when a container lport is changed to a normal
lport and then deleted.

 (gdb) bt
   0  in raise () from /lib64/libc.so.6
   1  in abort () from /lib64/libc.so.6
   2  ovs_abort_valist ("%s: assertion %s failed in %s()") at lib/util.c:419
   3  vlog_abort_valist ("%s: assertion %s failed in %s()") at lib/vlog.c:1249
   4  vlog_abort ("%s: assertion %s failed in %s()") at lib/vlog.c:1263
   5  ovs_assert_failure (where="lib/ovsdb-idl.c:4653",
                          condition="row->new_datum != NULL") at lib/util.c:86
   6  ovsdb_idl_txn_write__ () at lib/ovsdb-idl.c:4695
   7  ovsdb_idl_txn_write_clone () at lib/ovsdb-idl.c:4757
   8  sbrec_port_binding_set_chassis () at lib/ovn-sb-idl.c:25946
   9  release_lport () at controller/binding.c:971
  10  release_local_binding_children () at controller/binding.c:1039
  11  release_local_binding () at controller/binding.c:1056
  12  consider_iface_release (iface_rec=.. iface_id="bb43e818-b2ee-4329-b67e-218556580056") at controller/binding.c:1880
  13  binding_handle_ovs_interface_changes () at controller/binding.c:1998
  14  runtime_data_ovs_interface_handler () at controller/ovn-controller.c:1481
  15  engine_compute () at lib/inc-proc-eng.c:306
  16  engine_run_node () at lib/inc-proc-eng.c:352
  17  engine_run () at lib/inc-proc-eng.c:377
  18  main () at controller/ovn-controller.c:2826

The present code creates a 'struct local_binding' instance for a
container lport and adds this object to the parent local binding
children list.  And if the container lport is changed to a normal
vif, then there is no way to access the local binding object created
earlier.  This patch fixes these type of issues by refactoring the
'local binding' code of binding.c.  This patch now creates only one
instance of 'struct local_binding' for every OVS interface with
external_ids:iface-id set.  A new structure 'struct binding_lport' is
added which is created for a VIF, container and virtual port bindings
and is stored in 'binding_lports' shash.  'struct local_binding' now
maintains a list of binding_lports which it maps to.

When a container lport is changed to a normal lport, we now can
easily access the 'binding_lport' object of the container lport
fron the 'binding_lports' shash.

A new debug unixctl command is added - debug/dump-local-bindings,
which dumps the local bindings stored by the ovn-controller.  This
command is also used in the test cases to validate that ovn-controller
maintains proper local bindings.

Reported-by: Dumitru Ceara <dceara at redhat.com>
Reported-at: https://bugzilla.redhat.com/show_bug.cgi?id=1936328
Reported-at: https://bugzilla.redhat.com/show_bug.cgi?id=1936331

Acked-by: Dumitru Ceara <dceara at redhat.com>
Signed-off-by: Numan Siddique <numans at ovn.org>
(cherry picked from master commit e1e78b4b1481da69221b1cae999cbcc7d96fb458)

More information about the git mailing list