Facets maintain a pointer to their owning ofproto-dpif, and therefore
when an ofproto-dpif is destroyed all of their child facets should be
destroyed along with it. If they aren't, it's possible a subfacet
looked up in the dpif-backer could access it's parent facet and
therefore a defunct parent ofproto causing a segmentation fault.
Bug #19421.
Bug #19423.
Diagnosed-by: Ben Pfaff <b...@nicira.com>
Signed-off-by: Ethan Jackson <et...@nicira.com>
---
ofproto/ofproto-dpif.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/ofproto/ofproto-dpif.c b/ofproto/ofproto-dpif.c
index 70a226c..d241c8a 100644
--- a/ofproto/ofproto-dpif.c
+++ b/ofproto/ofproto-dpif.c
@@ -1421,8 +1421,17 @@ destruct(struct ofproto *ofproto_)
struct rule_dpif *rule, *next_rule;
struct ofputil_packet_in *pin, *next_pin;
struct ofputil_flow_mod *fm, *next_fm;
+ struct facet *facet, *next_facet;
+ struct cls_cursor cursor;
struct oftable *table;
+ ovs_rwlock_rdlock(&ofproto->facets.rwlock);
+ cls_cursor_init(&cursor, &ofproto->facets, NULL);
+ CLS_CURSOR_FOR_EACH_SAFE (facet, next_facet, cr, &cursor) {
+ facet_remove(facet);
+ }
+ ovs_rwlock_unlock(&ofproto->facets.rwlock);
+
ofproto->backer->need_revalidate = REV_RECONFIGURE;
ovs_rwlock_wrlock(&xlate_rwlock);
xlate_remove_ofproto(ofproto);
--
1.7.9.5
_______________________________________________
dev mailing list
dev@openvswitch.org
http://openvswitch.org/mailman/listinfo/dev
