upcall: Unregister dpif cbs in udpif_destroy().

During udpif_create(), we register callbacks for handling upcalls and purging the datapath; however, in the corresponding udpif_destroy() we never did this. This could potentially lead to dereference of uninitialized memory in the userspace datapath if the main thread destroys the udpif then executes an OpenFlow packet-out. Fixes: e4e74c3 ("dpif-netdev: Purge all ukeys when reconfigure pmd.") Fixes: 623540e ("dpif-netdev: Streamline miss handling.") Reported-by: William Tu <[email protected]> Signed-off-by: Joe Stringer <[email protected]> Acked-by: Ben Pfaff <[email protected]>
huikang · May 24, 2016 · b803e6a · b803e6a
1 parent 050c60b
commit b803e6a
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/ofproto/ofproto-dpif-upcall.c b/ofproto/ofproto-dpif-upcall.c
@@ -434,6 +434,9 @@ udpif_destroy(struct udpif *udpif)
 {
     udpif_stop_threads(udpif);
 
+    dpif_register_dp_purge_cb(udpif->dpif, NULL, udpif);
+    dpif_register_upcall_cb(udpif->dpif, NULL, udpif);
+
     for (int i = 0; i < N_UMAPS; i++) {
         cmap_destroy(&udpif->ukeys[i].cmap);
         ovs_mutex_destroy(&udpif->ukeys[i].mutex);