netdev-port: Fix invalid memory access in netdev_vport_poll_add().

[openvswitch] / vswitchd / bridge.c

diff --git a/vswitchd/bridge.c b/vswitchd/bridge.c
index 197b6ed44219fdc999fd23b68973f4f87eb1d944..1558d3bb90d3afc79cc7cbbb6a94b9a66af98d77 100644 (file)
--- a/vswitchd/bridge.c
+++ b/vswitchd/bridge.c
@@ -526,13 +526,10 @@ collect_in_band_managers(const struct ovsrec_open_vswitch *ovs_cfg,
     struct shash targets;
     size_t i;
 
-    /* Collect all of the potential targets, as the union of the "managers"
-     * column and the "targets" columns of the rows pointed to by
-     * "manager_options", excluding any that are out-of-band. */
+    /* Collect all of the potential targets from the "targets" columns of the
+     * rows pointed to by "manager_options", excluding any that are
+     * out-of-band. */
     shash_init(&targets);
-    for (i = 0; i < ovs_cfg->n_managers; i++) {
-        shash_add_once(&targets, ovs_cfg->managers[i], NULL);
-    }
     for (i = 0; i < ovs_cfg->n_manager_options; i++) {
         struct ovsrec_manager *m = ovs_cfg->manager_options[i];
 
@@ -984,7 +981,7 @@ bridge_pick_local_hw_addr(struct bridge *br, uint8_t ea[ETH_ADDR_LEN],
 
     /* Otherwise choose the minimum non-local MAC address among all of the
      * interfaces. */
-    memset(ea, 0xff, sizeof ea);
+    memset(ea, 0xff, ETH_ADDR_LEN);
     for (i = 0; i < br->n_ports; i++) {
         struct port *port = br->ports[i];
         uint8_t iface_ea[ETH_ADDR_LEN];
@@ -3032,7 +3029,7 @@ static void
 bridge_account_flow_ofhook_cb(const struct flow *flow, tag_type tags,
                               const struct nlattr *actions,
                               size_t actions_len,
-                              unsigned long long int n_bytes, void *br_)
+                              uint64_t n_bytes, void *br_)
 {
     struct bridge *br = br_;
     const struct nlattr *a;
@@ -4530,6 +4527,8 @@ port_update_bonding(struct port *port)
         free(port->bond_hash);
         port->bond_hash = NULL;
         port->bond_fake_iface = false;
+        port->active_iface = -1;
+        port->no_ifaces_tag = 0;
     } else {
         size_t i;
 
@@ -4540,19 +4539,25 @@ port_update_bonding(struct port *port)
                 e->iface_idx = -1;
                 e->tx_bytes = 0;
             }
-            port->no_ifaces_tag = tag_create_random();
-            bond_choose_active_iface(port);
             port->bond_next_rebalance
                 = time_msec() + port->bond_rebalance_interval;
-
-            if (port->cfg->bond_fake_iface) {
-                port->bond_next_fake_iface_update = time_msec();
-            }
         } else if (port->bond_mode == BM_AB) {
             free(port->bond_hash);
             port->bond_hash = NULL;
         }
+
+        if (!port->no_ifaces_tag) {
+            port->no_ifaces_tag = tag_create_random();
+        }
+
+        if (port->active_iface < 0) {
+            bond_choose_active_iface(port);
+        }
+
         port->bond_fake_iface = port->cfg->bond_fake_iface;
+        if (port->bond_fake_iface) {
+            port->bond_next_fake_iface_update = time_msec();
+        }
 
         if (!port->miimon) {
             port->monitor = netdev_monitor_create();