Currently, the cmap_destroy() directly frees the cmap memory.
Some callers of cmap_destroy() (e.g. destroy_subtable()) still
allows other threads (e.g. pmd threads) accessing the cmap at
the same time (e.g. via classifier_lookup_miniflow_batch()),
which could cause segfault.

To fix the above issue, this commit use ovsrcu to postpone
the free of cmap memory.

Reported-by: Ethan Jackson <et...@nicira.com>
Signed-off-by: Alex Wang <al...@nicira.com>
---
 lib/cmap.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/cmap.c b/lib/cmap.c
index ba744cc..db2b4a4 100644
--- a/lib/cmap.c
+++ b/lib/cmap.c
@@ -240,7 +240,7 @@ void
 cmap_destroy(struct cmap *cmap)
 {
     if (cmap) {
-        free_cacheline(cmap_get_impl(cmap));
+        ovsrcu_postpone(free_cacheline, cmap_get_impl(cmap));
     }
 }
 
-- 
1.7.9.5

_______________________________________________
dev mailing list
dev@openvswitch.org
http://openvswitch.org/mailman/listinfo/dev

Reply via email to