On 2/4/22 17:54, Dumitru Ceara wrote:
> Transactions that are still incomplete (waiting for a reply from the
> server) are kept in the IDL's 'outstanding_txns' map. When a transaction
> is destroyed, ovsdb_idl_txn_destroy() will take care of removing the
> transaction from the 'outstanding_txns' map if the transaction was
> incomplete but also abort it and disassemble it if needed.
>
> Aborting the transaction first, before ovsdb_idl_txn_destroy(), may
> cause an use-after-free if the transaction was outstanding; that's
> because the transaction would move to state "aborted" without being
> removed from the 'outstanding_txns' map.
>
> Fixes: 53a540e5311c ("ovsdb-idl: ovsdb_idl_loop_destroy must also destroy the
> committing txn.")
> Signed-off-by: Dumitru Ceara <[email protected]>
> ---
> v2:
> - Removed unnecessary ovsdb_idl_txn_disassemble() call per Ilya's
> comment.
> - Rephrased the commit log.
> ---
> lib/ovsdb-idl.c | 1 -
> 1 file changed, 1 deletion(-)
Thanks! Applied and backported down to 2.13.
Best regards, Ilya Maximets.
_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
