Thx Andy for providing the core file.  It is very helpful!

The root cause is that:

1. when udpif_flush() is called, it sets both n-handlers and n-revalidators
to 0
2. in refresh_channels() (dpif-linux.c), though the new 'n_handlers = 0',
we still try
    dpif->handlers = xzalloc(n_handlers * sizeof *dpif->handlers).
3. 'xzalloc(0)' is equivalent to 'malloc(1)' in ovs.  So, 'dpif->handlers'
will point to a
    random address of 1 byte.  And future dereference will result in
SEGFAULT.

I think a better fix is to check if the new 'n_handlers' is zero,
'dpif->handlers = NULL'.

I'll send out a separate patch.

Thx,
Alex Wang,




On Mon, Apr 21, 2014 at 10:02 AM, Alex Wang <al...@nicira.com> wrote:

> Hey Andy,
>
> Thx for the fix.  Could you provide more info on how to reproduce it?
>  maybe the backtrace?
>
> I expect vport_del_channels() to be called only when 'port_idx >=
> dpif->uc_array_size' or dpif->handlers[0].channels is non-NULL.
>
> I want to know more about the context.
>
> Thx
>  Alex Wang,
>
>
> On Sun, Apr 20, 2014 at 11:47 PM, Andy Zhou <az...@nicira.com> wrote:
>
>> When testing megaflow bond implement I ran into a case where
>> dpif->handler[0].channels is NULL. Indexing into channels causes
>> vswitchd to crash. Not sure this is the best way to fix it, but
>> it worked for me.
>>
>> Signed-off-by: Andy Zhou <az...@nicira.com>
>> ---
>>  lib/dpif-linux.c |    4 ++++
>>  1 file changed, 4 insertions(+)
>>
>> diff --git a/lib/dpif-linux.c b/lib/dpif-linux.c
>> index a575b78..9ba6e6a 100644
>> --- a/lib/dpif-linux.c
>> +++ b/lib/dpif-linux.c
>> @@ -441,6 +441,10 @@ vport_del_channels(struct dpif_linux *dpif,
>> odp_port_t port_no)
>>          return;
>>      }
>>
>> +    if (!dpif->handlers[0].channels) {
>> +        return;
>> +    }
>> +
>>      /* Since the sock can only be assigned in either all or none
>>       * of "dpif->handlers" channels, the following check would
>>       * suffice. */
>> --
>> 1.7.9.5
>>
>> _______________________________________________
>> dev mailing list
>> dev@openvswitch.org
>> http://openvswitch.org/mailman/listinfo/dev
>>
>
>
_______________________________________________
dev mailing list
dev@openvswitch.org
http://openvswitch.org/mailman/listinfo/dev

Reply via email to