| Message ID | 20161116001504.5608-1-joe@ovn.org |
|---|---|
| State | Accepted |
| Headers | show |
On Tue, Nov 15, 2016 at 04:15:04PM -0800, Joe Stringer wrote: > netdev_get_vports() previously counted the number of ports outside the > mutex, allocated enough memory for that number, then grabbed the mutex > to iterate through them and filled the array with the pointers. > > This is logically wrong; in theory the number of ports could change > between allocating the memory and grabbing the mutex. In practice, only > the main thread manages these so there is no chance for a segfault. Fix > it up anyway. > > Signed-off-by: Joe Stringer <joe@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org>
On 15 November 2016 at 16:37, Ben Pfaff <blp@ovn.org> wrote: > On Tue, Nov 15, 2016 at 04:15:04PM -0800, Joe Stringer wrote: >> netdev_get_vports() previously counted the number of ports outside the >> mutex, allocated enough memory for that number, then grabbed the mutex >> to iterate through them and filled the array with the pointers. >> >> This is logically wrong; in theory the number of ports could change >> between allocating the memory and grabbing the mutex. In practice, only >> the main thread manages these so there is no chance for a segfault. Fix >> it up anyway. >> >> Signed-off-by: Joe Stringer <joe@ovn.org> > > Acked-by: Ben Pfaff <blp@ovn.org> Thanks, applied.
diff --git a/lib/netdev.c b/lib/netdev.c index 6c4c6571e295..b817ef1d4a4d 100644 --- a/lib/netdev.c +++ b/lib/netdev.c @@ -1766,8 +1766,8 @@ netdev_get_vports(size_t *size) } /* Explicitly allocates big enough chunk of memory. */ - vports = xmalloc(shash_count(&netdev_shash) * sizeof *vports); ovs_mutex_lock(&netdev_mutex); + vports = xmalloc(shash_count(&netdev_shash) * sizeof *vports); SHASH_FOR_EACH (node, &netdev_shash) { struct netdev *dev = node->data;
netdev_get_vports() previously counted the number of ports outside the mutex, allocated enough memory for that number, then grabbed the mutex to iterate through them and filled the array with the pointers. This is logically wrong; in theory the number of ports could change between allocating the memory and grabbing the mutex. In practice, only the main thread manages these so there is no chance for a segfault. Fix it up anyway. Signed-off-by: Joe Stringer <joe@ovn.org> --- lib/netdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)