diff mbox series

[ovs-dev,01/13] replication: Avoid theoretical use-after-free error in reset_database().

Message ID 20171007004458.5788-2-blp@ovn.org
State Accepted
Headers show
Series clustering implementation, part 1 | expand

Commit Message

Ben Pfaff Oct. 7, 2017, 12:44 a.m. UTC 
Code that calls ovsdb_txn_row_delete() should avoid referencing the
deleted row again, because it might be freed.  In practice this shouldn't
really happen in this case because of the particular circumstances, but it
costs little to be careful.

Signed-off-by: Ben Pfaff <blp@ovn.org>
---
 ovsdb/replication.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Comments

Russell Bryant Oct. 7, 2017, 2:19 a.m. UTC | #1 
On Fri, Oct 6, 2017 at 8:44 PM, Ben Pfaff <blp@ovn.org> wrote:
> Code that calls ovsdb_txn_row_delete() should avoid referencing the
> deleted row again, because it might be freed.  In practice this shouldn't
> really happen in this case because of the particular circumstances, but it
> costs little to be careful.
>
> Signed-off-by: Ben Pfaff <blp@ovn.org>

Acked-by: Russell Bryant <russell@ovn.org>
Ben Pfaff Oct. 7, 2017, 4:02 a.m. UTC | #2 
On Fri, Oct 06, 2017 at 10:19:59PM -0400, Russell Bryant wrote:
> On Fri, Oct 6, 2017 at 8:44 PM, Ben Pfaff <blp@ovn.org> wrote:
> > Code that calls ovsdb_txn_row_delete() should avoid referencing the
> > deleted row again, because it might be freed.  In practice this shouldn't
> > really happen in this case because of the particular circumstances, but it
> > costs little to be careful.
> >
> > Signed-off-by: Ben Pfaff <blp@ovn.org>
> 
> Acked-by: Russell Bryant <russell@ovn.org>

Thanks, I applied this patch to master and backported as far as
branch-2.6.
diff mbox series

Patch

diff --git a/ovsdb/replication.c b/ovsdb/replication.c
index 304212d9d93a..47b0af19bbf6 100644
--- a/ovsdb/replication.c
+++ b/ovsdb/replication.c
@@ -529,8 +529,8 @@  reset_database(struct ovsdb *db)
         /* Delete all rows if the table is not blacklisted. */
         if (!blacklist_tables_find(db->schema->name, table_node->name)) {
             struct ovsdb_table *table = table_node->data;
-            struct ovsdb_row *row;
-            HMAP_FOR_EACH (row, hmap_node, &table->rows) {
+            struct ovsdb_row *row, *next;
+            HMAP_FOR_EACH_SAFE (row, next, hmap_node, &table->rows) {
                 ovsdb_txn_row_delete(txn, row);
             }
         }