When dpif_recv_set returns an error, close_dpif_backer gets called,
which in term calls recirc_id_pool_destroy, which can lead to a crash
since recirc_id_pool_create() was not called before this patch.
Reported-by: Mukesh Hira <mh...@vmware.com>
Signed-off-by: Andy Zhou <az...@nicira.com>
---
ofproto/ofproto-dpif.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/ofproto/ofproto-dpif.c b/ofproto/ofproto-dpif.c
index 980b04f..e501150 100644
--- a/ofproto/ofproto-dpif.c
+++ b/ofproto/ofproto-dpif.c
@@ -920,6 +920,11 @@ open_dpif_backer(const char *type, struct dpif_backer
**backerp)
shash_add(&all_dpif_backers, type, backer);
+ backer->enable_recirc = check_recirc(backer);
+ backer->variable_length_userdata = check_variable_length_userdata(backer);
+ backer->max_mpls_depth = check_max_mpls_depth(backer);
+ backer->rid_pool = recirc_id_pool_create();
+
error = dpif_recv_set(backer->dpif, backer->recv_set_enable);
if (error) {
VLOG_ERR("failed to listen on datapath of type %s: %s",
@@ -927,10 +932,6 @@ open_dpif_backer(const char *type, struct dpif_backer
**backerp)
close_dpif_backer(backer);
return error;
}
- backer->enable_recirc = check_recirc(backer);
- backer->variable_length_userdata = check_variable_length_userdata(backer);
- backer->max_mpls_depth = check_max_mpls_depth(backer);
- backer->rid_pool = recirc_id_pool_create();
if (backer->recv_set_enable) {
udpif_set_threads(backer->udpif, n_handlers, n_revalidators);
--
1.9.1
_______________________________________________
dev mailing list
dev@openvswitch.org
http://openvswitch.org/mailman/listinfo/dev
