Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
netdev-dummy: fix crash with more than one passive connection
Investigation found that Some of the occasional failures in the "ovn -- vtep: 3 HVs, 1 VIFs/HV, 1 GW, 1 LS" test case are caused by ovs-vswitchd crashing with SIGSEGV. It turns out that the crash occurrs when the number of netdev-dummy passive connections transitions from 1 to 2. When xrealloc() copies the array of dummy_packet_stream structures from the original buffer to a newly allocated one, the struct ovs_list txq member of the structure becomes corrupt (e.g. if ovs_list_is_empty() would have returned false before the copy, it will return true after the copy, which will lead to a crash when the bogus packet buffer on the list is dereferenced). Fix by taking a hint from David Wheeler and adding a level of indirection. Signed-off-by: Lance Richardson <lrichard@redhat.com> [blp@ovn.org folded in an additional bug fix] Signed-off-by: Ben Pfaff <blp@ovn.org>
- Loading branch information