When revalidation occurs at the same time that a bridge is being removed or ovs-vswitchd is exiting, xlate_lookup_ofproto() races with deletion of the ofproto. This caused a null pointer dereference if revalidation lost the race. This commit fixes the problem.
Reported-by: Jakub Sitnicki <[email protected]> Signed-off-by: Ben Pfaff <[email protected]> --- ofproto/ofproto-dpif-upcall.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ofproto/ofproto-dpif-upcall.c b/ofproto/ofproto-dpif-upcall.c index 4a71bbe258df..e52871da2b81 100644 --- a/ofproto/ofproto-dpif-upcall.c +++ b/ofproto/ofproto-dpif-upcall.c @@ -2047,8 +2047,8 @@ revalidate_ukey__(struct udpif *udpif, const struct udpif_key *ukey, if (xoutp->slow) { struct ofproto_dpif *ofproto; ofproto = xlate_lookup_ofproto(udpif->backer, &ctx.flow, NULL); - uint32_t smid = ofproto->up.slowpath_meter_id; - uint32_t cmid = ofproto->up.controller_meter_id; + uint32_t smid = ofproto ? ofproto->up.slowpath_meter_id : UINT32_MAX; + uint32_t cmid = ofproto ? ofproto->up.controller_meter_id : UINT32_MAX; ofpbuf_clear(odp_actions); compose_slow_path(udpif, xoutp, &ctx.flow, ctx.flow.in_port.odp_port, -- 2.10.2 _______________________________________________ dev mailing list [email protected] https://mail.openvswitch.org/mailman/listinfo/ovs-dev
