{"id":831377,"url":"http://patchwork.ozlabs.org/api/1.2/patches/831377/?format=json","web_url":"http://patchwork.ozlabs.org/project/openvswitch/patch/20171027154023.14307-1-blp@ovn.org/","project":{"id":47,"url":"http://patchwork.ozlabs.org/api/1.2/projects/47/?format=json","name":"Open vSwitch","link_name":"openvswitch","list_id":"ovs-dev.openvswitch.org","list_email":"ovs-dev@openvswitch.org","web_url":"http://openvswitch.org/","scm_url":"git@github.com:openvswitch/ovs.git","webscm_url":"https://github.com/openvswitch/ovs","list_archive_url":"","list_archive_url_format":"","commit_url_format":""},"msgid":"<20171027154023.14307-1-blp@ovn.org>","list_archive_url":null,"date":"2017-10-27T15:40:23","name":"[ovs-dev] ofproto-dpif-upcall: Fix null pointer dereference on exit.","commit_ref":null,"pull_url":null,"state":"accepted","archived":false,"hash":"24237d3e803e2c9365debbdc54a52b14efdeb067","submitter":{"id":67603,"url":"http://patchwork.ozlabs.org/api/1.2/people/67603/?format=json","name":"Ben Pfaff","email":"blp@ovn.org"},"delegate":null,"mbox":"http://patchwork.ozlabs.org/project/openvswitch/patch/20171027154023.14307-1-blp@ovn.org/mbox/","series":[{"id":10608,"url":"http://patchwork.ozlabs.org/api/1.2/series/10608/?format=json","web_url":"http://patchwork.ozlabs.org/project/openvswitch/list/?series=10608","date":"2017-10-27T15:40:23","name":"[ovs-dev] ofproto-dpif-upcall: Fix null pointer dereference on exit.","version":1,"mbox":"http://patchwork.ozlabs.org/series/10608/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/patches/831377/comments/","check":"pending","checks":"http://patchwork.ozlabs.org/api/patches/831377/checks/","tags":{},"related":[],"headers":{"Return-Path":"","X-Original-To":["incoming@patchwork.ozlabs.org","dev@openvswitch.org"],"Delivered-To":["patchwork-incoming@bilbo.ozlabs.org","ovs-dev@mail.linuxfoundation.org"],"Authentication-Results":"ozlabs.org;\n\tspf=pass (mailfrom) smtp.mailfrom=openvswitch.org\n\t(client-ip=140.211.169.12; helo=mail.linuxfoundation.org;\n\tenvelope-from=ovs-dev-bounces@openvswitch.org;\n\treceiver=)","Received":["from mail.linuxfoundation.org (mail.linuxfoundation.org\n\t[140.211.169.12])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256\n\tbits)) (No client certificate requested)\n\tby ozlabs.org (Postfix) with ESMTPS id 3yNp413MsTz9t4X\n\tfor ;\n\tSat, 28 Oct 2017 02:40:33 +1100 (AEDT)","from mail.linux-foundation.org (localhost [127.0.0.1])\n\tby mail.linuxfoundation.org (Postfix) with ESMTP id C80AFAA5;\n\tFri, 27 Oct 2017 15:40:31 +0000 (UTC)","from smtp1.linuxfoundation.org (smtp1.linux-foundation.org\n\t[172.17.192.35])\n\tby mail.linuxfoundation.org (Postfix) with ESMTPS id 0990DA73\n\tfor ; Fri, 27 Oct 2017 15:40:31 +0000 (UTC)","from relay2-d.mail.gandi.net (relay2-d.mail.gandi.net\n\t[217.70.183.194])\n\tby smtp1.linuxfoundation.org (Postfix) with ESMTPS id 88C594D7\n\tfor ; Fri, 27 Oct 2017 15:40:30 +0000 (UTC)","from sigabrt.gateway.sonic.net\n\t(173-228-112-34.dsl.dynamic.fusionbroadband.com [173.228.112.34])\n\t(Authenticated sender: blp@ovn.org)\n\tby relay2-d.mail.gandi.net (Postfix) with ESMTPSA id 6ACDCC5A63;\n\tFri, 27 Oct 2017 17:40:26 +0200 (CEST)"],"X-Greylist":"domain auto-whitelisted by SQLgrey-1.7.6","X-Originating-IP":"173.228.112.34","From":"Ben Pfaff ","To":"dev@openvswitch.org","Date":"Fri, 27 Oct 2017 08:40:23 -0700","Message-Id":"<20171027154023.14307-1-blp@ovn.org>","X-Mailer":"git-send-email 2.10.2","X-Spam-Status":"No, score=-0.7 required=5.0 tests=RCVD_IN_DNSWL_LOW\n\tautolearn=disabled version=3.3.1","X-Spam-Checker-Version":"SpamAssassin 3.3.1 (2010-03-16) on\n\tsmtp1.linux-foundation.org","Cc":"Ben Pfaff ","Subject":"[ovs-dev] [PATCH] ofproto-dpif-upcall: Fix null pointer dereference\n\ton exit.","X-BeenThere":"ovs-dev@openvswitch.org","X-Mailman-Version":"2.1.12","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","MIME-Version":"1.0","Content-Type":"text/plain; charset=\"us-ascii\"","Content-Transfer-Encoding":"7bit","Sender":"ovs-dev-bounces@openvswitch.org","Errors-To":"ovs-dev-bounces@openvswitch.org"},"content":"When revalidation occurs at the same time that a bridge is being removed\nor ovs-vswitchd is exiting, xlate_lookup_ofproto() races with deletion of\nthe ofproto. This caused a null pointer dereference if revalidation lost\nthe race. This commit fixes the problem.\n\nReported-by: Jakub Sitnicki \nSigned-off-by: Ben Pfaff \n---\n ofproto/ofproto-dpif-upcall.c | 4 ++--\n 1 file changed, 2 insertions(+), 2 deletions(-)","diff":"diff --git a/ofproto/ofproto-dpif-upcall.c b/ofproto/ofproto-dpif-upcall.c\nindex 4a71bbe258df..e52871da2b81 100644\n--- a/ofproto/ofproto-dpif-upcall.c\n+++ b/ofproto/ofproto-dpif-upcall.c\n@@ -2047,8 +2047,8 @@ revalidate_ukey__(struct udpif *udpif, const struct udpif_key *ukey,\n if (xoutp->slow) {\n struct ofproto_dpif *ofproto;\n ofproto = xlate_lookup_ofproto(udpif->backer, &ctx.flow, NULL);\n- uint32_t smid = ofproto->up.slowpath_meter_id;\n- uint32_t cmid = ofproto->up.controller_meter_id;\n+ uint32_t smid = ofproto ? ofproto->up.slowpath_meter_id : UINT32_MAX;\n+ uint32_t cmid = ofproto ? ofproto->up.controller_meter_id : UINT32_MAX;\n \n ofpbuf_clear(odp_actions);\n compose_slow_path(udpif, xoutp, &ctx.flow, ctx.flow.in_port.odp_port,\n","prefixes":["ovs-dev"]}