diff mbox series

[ovs-dev,1/3] dpif-netdev: Fix cmap node use after free on flow disassociation.

Message ID 20181019135115.17659-2-i.maximets@samsung.com
State Accepted
Delegated to: Ian Stokes
Headers show
Series Few more fixes/enhancements for rte_flow offloading. | expand

Commit Message

Ilya Maximets Oct. 19, 2018, 1:51 p.m. UTC
Data pointed by cmap node must not be freed while iterating.
ovsrcu_postpone should be used instead.

CC: Finn Christensen <fc@napatech.com>
Fixes: e8a2b5bf92bb ("netdev-dpdk: implement flow offload with rte flow")
Signed-off-by: Ilya Maximets <i.maximets@samsung.com>
---
 lib/dpif-netdev.c | 2 +-
 lib/netdev-dpdk.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

Comments

Stokes, Ian Oct. 31, 2018, 2:01 p.m. UTC | #1
> Data pointed by cmap node must not be freed while iterating.
> ovsrcu_postpone should be used instead.
> 

LGTM, I'll include this is this weeks pull request.

Ian

> CC: Finn Christensen <fc@napatech.com>
> Fixes: e8a2b5bf92bb ("netdev-dpdk: implement flow offload with rte flow")
> Signed-off-by: Ilya Maximets <i.maximets@samsung.com>
> ---
>  lib/dpif-netdev.c | 2 +-
>  lib/netdev-dpdk.c | 2 +-
>  2 files changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/lib/dpif-netdev.c b/lib/dpif-netdev.c index
> c44c417d3..3f7acb5dd 100644
> --- a/lib/dpif-netdev.c
> +++ b/lib/dpif-netdev.c
> @@ -2136,7 +2136,7 @@ megaflow_to_mark_disassociate(const ovs_u128
> *mega_ufid)
>          if (ovs_u128_equals(*mega_ufid, data->mega_ufid)) {
>              cmap_remove(&flow_mark.megaflow_to_mark,
>                          CONST_CAST(struct cmap_node *, &data->node),
> hash);
> -            free(data);
> +            ovsrcu_postpone(free, data);
>              return;
>          }
>      }
> diff --git a/lib/netdev-dpdk.c b/lib/netdev-dpdk.c index
> 78a981d8f..d2b392f61 100644
> --- a/lib/netdev-dpdk.c
> +++ b/lib/netdev-dpdk.c
> @@ -4043,7 +4043,7 @@ ufid_to_rte_flow_disassociate(const ovs_u128 *ufid)
> {
>          if (ovs_u128_equals(*ufid, data->ufid)) {
>              cmap_remove(&ufid_to_rte_flow,
>                          CONST_CAST(struct cmap_node *, &data->node),
> hash);
> -            free(data);
> +            ovsrcu_postpone(free, data);
>              return;
>          }
>      }
> --
> 2.17.1
diff mbox series

Patch

diff --git a/lib/dpif-netdev.c b/lib/dpif-netdev.c
index c44c417d3..3f7acb5dd 100644
--- a/lib/dpif-netdev.c
+++ b/lib/dpif-netdev.c
@@ -2136,7 +2136,7 @@  megaflow_to_mark_disassociate(const ovs_u128 *mega_ufid)
         if (ovs_u128_equals(*mega_ufid, data->mega_ufid)) {
             cmap_remove(&flow_mark.megaflow_to_mark,
                         CONST_CAST(struct cmap_node *, &data->node), hash);
-            free(data);
+            ovsrcu_postpone(free, data);
             return;
         }
     }
diff --git a/lib/netdev-dpdk.c b/lib/netdev-dpdk.c
index 78a981d8f..d2b392f61 100644
--- a/lib/netdev-dpdk.c
+++ b/lib/netdev-dpdk.c
@@ -4043,7 +4043,7 @@  ufid_to_rte_flow_disassociate(const ovs_u128 *ufid) {
         if (ovs_u128_equals(*ufid, data->ufid)) {
             cmap_remove(&ufid_to_rte_flow,
                         CONST_CAST(struct cmap_node *, &data->node), hash);
-            free(data);
+            ovsrcu_postpone(free, data);
             return;
         }
     }