Do not free uninitialized packets.
authorJarno Rajahalme <jrajahalme@nicira.com>
Tue, 17 Dec 2013 23:54:30 +0000 (15:54 -0800)
committerJarno Rajahalme <jrajahalme@nicira.com>
Tue, 17 Dec 2013 23:54:30 +0000 (15:54 -0800)
commit837a88dccb2634c26f3a70af37b86cae8a48ad74
tree3d412f11578a7a67e5b0143224b634fa329ba85f
parent877c9270fb28ae61b0de4b3dba74ef33adc4d7be
Do not free uninitialized packets.

Commit da546e0 (dpif: Allow execute to modify the packet.) uninitializes
the "dpif_upcall.packet" of "struct upcall" when dpif_recv() returns error.
The packet ofpbuf is likely uninitialized in this case, hence calling
ofpbuf_uninit() on it will likely cause a SEGFAULT.

This commit fixes this bug by only uninitializing packet's ofpbuf on
successfully received upcalls.

A note warning about this is added on the comment of dpif_recv() in
dpif.c and dpif-provider.h.

Reported-by: Alex Wang <alexw@nicira.com>
Signed-off-by: Jarno Rajahalme <jrajahalme@nicira.com>
Acked-by: Ben Pfaff <blp@nicira.com>
lib/dpif-provider.h
lib/dpif.c
ofproto/ofproto-dpif-upcall.c