From patchwork Thu Apr 20 05:24:08 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tao Liu X-Patchwork-Id: 1771500 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=openvswitch.org (client-ip=2605:bc80:3010::138; helo=smtp1.osuosl.org; envelope-from=ovs-dev-bounces@openvswitch.org; receiver=) Authentication-Results: legolas.ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=163.com header.i=@163.com header.a=rsa-sha256 header.s=s110527 header.b=Psc6+Yn5; dkim-atps=neutral Received: from smtp1.osuosl.org (smtp1.osuosl.org [IPv6:2605:bc80:3010::138]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4Q2Mjp0sYjz23td for ; Fri, 21 Apr 2023 01:57:18 +1000 (AEST) Received: from localhost (localhost [127.0.0.1]) by smtp1.osuosl.org (Postfix) with ESMTP id 364EA842DB; Thu, 20 Apr 2023 15:57:16 +0000 (UTC) DKIM-Filter: OpenDKIM Filter v2.11.0 smtp1.osuosl.org 364EA842DB Authentication-Results: smtp1.osuosl.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=163.com header.i=@163.com header.a=rsa-sha256 header.s=s110527 header.b=Psc6+Yn5 X-Virus-Scanned: amavisd-new at osuosl.org Received: from smtp1.osuosl.org ([127.0.0.1]) by localhost (smtp1.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9ny9qTMK1ucV; Thu, 20 Apr 2023 15:57:15 +0000 (UTC) Received: from lists.linuxfoundation.org (lf-lists.osuosl.org [140.211.9.56]) by smtp1.osuosl.org (Postfix) with ESMTPS id 0D5ED842B0; Thu, 20 Apr 2023 15:57:14 +0000 (UTC) DKIM-Filter: OpenDKIM Filter v2.11.0 smtp1.osuosl.org 0D5ED842B0 Received: from lf-lists.osuosl.org (localhost [127.0.0.1]) by lists.linuxfoundation.org (Postfix) with ESMTP id D899CC0036; Thu, 20 Apr 2023 15:57:13 +0000 (UTC) X-Original-To: dev@openvswitch.org Delivered-To: ovs-dev@lists.linuxfoundation.org Received: from smtp2.osuosl.org (smtp2.osuosl.org [140.211.166.133]) by lists.linuxfoundation.org (Postfix) with ESMTP id ECE8DC002A for ; Thu, 20 Apr 2023 05:39:12 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp2.osuosl.org (Postfix) with ESMTP id D5240400F1 for ; Thu, 20 Apr 2023 05:39:12 +0000 (UTC) DKIM-Filter: OpenDKIM Filter v2.11.0 smtp2.osuosl.org D5240400F1 Authentication-Results: smtp2.osuosl.org; dkim=pass (1024-bit key) header.d=163.com header.i=@163.com header.a=rsa-sha256 header.s=s110527 header.b=Psc6+Yn5 X-Virus-Scanned: amavisd-new at osuosl.org Received: from smtp2.osuosl.org ([127.0.0.1]) by localhost (smtp2.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id d7XwC0sY6jX6 for ; Thu, 20 Apr 2023 05:39:12 +0000 (UTC) X-Greylist: delayed 00:15:09 by SQLgrey-1.8.0 DKIM-Filter: OpenDKIM Filter v2.11.0 smtp2.osuosl.org E5F51400D1 Received: from m12.mail.163.com (m12.mail.163.com [220.181.12.217]) by smtp2.osuosl.org (Postfix) with ESMTP id E5F51400D1 for ; Thu, 20 Apr 2023 05:39:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=163.com; s=s110527; h=From:Subject:Date:Message-Id:MIME-Version; bh=IlMNd 1kkBJbJOY01+Sv6lvNzR96aHzQaIGWrqyl7kzc=; b=Psc6+Yn5oIg9UVkbLEmTq pe+0QNmtCrf2+wlZWU7m6F5gjeFO88USBwbqco10r1Qi5B+isF4sOVhn1OkaongY 2AUiyu5XM6yd3cR99klB6oskf4vcKuHAVbnb53VQN3zo58LniXXzefR3z1MDtOaA Rdr99IVw3NKBk1qAvTKpSA= Received: from localhost.localdomain (unknown [101.230.162.66]) by zwqz-smtp-mta-g3-4 (Coremail) with SMTP id _____wDn77tozEBk8BvVBw--.36802S2; Thu, 20 Apr 2023 13:23:52 +0800 (CST) From: Tao Liu To: dev@openvswitch.org Date: Thu, 20 Apr 2023 13:24:08 +0800 Message-Id: <20230420052408.1318505-1-taoliu828@163.com> X-Mailer: git-send-email 2.31.1 MIME-Version: 1.0 X-CM-TRANSID: _____wDn77tozEBk8BvVBw--.36802S2 X-Coremail-Antispam: 1Uf129KBjvdXoWrZFW3XFW7JF1fJrWUArWxtFb_yoWkGwcE9r yDWFn2ga45A3ZrJw1FvF1FyrsxX39xXr9FkFy0qFy5Ja4DJF4UG397C3s3Cw43urW5Z348 J3sFy3W29r429jkaLaAFLSUrUUUUUb8apTn2vfkv8UJUUUU8Yxn0WfASr-VFAUDa7-sFnT 9fnUUvcSsGvfC2KfnxnUUI43ZEXa7sRRE_M3UUUUU== X-Originating-IP: [101.230.162.66] X-CM-SenderInfo: xwdrzxbxysmqqrwthudrp/1tbiPQtXFGI0WzTKngAAsY X-Mailman-Approved-At: Thu, 20 Apr 2023 15:57:12 +0000 Cc: taoliu828@163.com Subject: [ovs-dev] [PATCH ovn] northd: fix use-after-free after lrp destroyed X-BeenThere: ovs-dev@openvswitch.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: ovs-dev-bounces@openvswitch.org Sender: "dev" In vxlan mode with more than 2047 lrp in router, build_ports() prints "all port tunnel ids exhausted", and frees the lrp port. However, lsp of type "router" connected to the lrp still holds the pointer in port->peer. This leads to northd crash in build_lflows(). CallTrace: build_lswitch_rport_arp_req_flows build_lswitch_ip_unicast_lookup build_lswitch_and_lrouter_iterate_by_op build_lflows en_lflow_run engine_recompute engine_run inc_proc_northd_run main Fixes: 3044132261d3 ("northd: Enhance implementation of port tunnel key requests.") Signed-off-by: Tao Liu --- northd/northd.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/northd/northd.c b/northd/northd.c index c10e5c20c..fe36a0362 100644 --- a/northd/northd.c +++ b/northd/northd.c @@ -4598,6 +4598,9 @@ ovn_port_allocate_key(const struct sbrec_chassis_table *sbrec_chassis_table, if (op->sb) { sbrec_port_binding_delete(op->sb); } + if (op->peer) { + op->peer->peer = NULL; + } ovs_list_remove(&op->list); ovn_port_destroy(ports, op); }