Nice catch.  Thanks.

--Justin


On Jun 7, 2012, at 1:08 PM, Ethan Jackson wrote:

> In one edge case, ofoperation_complete() destroys its rule, without
> updating its ofoperation that the rule is gone.  Later in the same
> function, ofoperation_destroy() attempts to modify the rule which
> already destroyed.
> 
> Signed-off-by: Ethan Jackson <[email protected]>
> ---
> ofproto/ofproto.c |    1 +
> 1 file changed, 1 insertion(+)
> 
> diff --git a/ofproto/ofproto.c b/ofproto/ofproto.c
> index 0c24314..eed0458 100644
> --- a/ofproto/ofproto.c
> +++ b/ofproto/ofproto.c
> @@ -3617,6 +3617,7 @@ ofoperation_complete(struct ofoperation *op, enum 
> ofperr error)
>         } else {
>             oftable_substitute_rule(rule, op->victim);
>             ofproto_rule_destroy__(rule);
> +            op->rule = NULL;
>         }
>         break;
> 
> -- 
> 1.7.10.2
> 
> _______________________________________________
> dev mailing list
> [email protected]
> http://openvswitch.org/mailman/listinfo/dev

_______________________________________________
dev mailing list
[email protected]
http://openvswitch.org/mailman/listinfo/dev

Reply via email to