netdev-port: Fix invalid memory access in netdev_vport_poll_add().

shash_find_data() returns an shash_node's 'data' member, but this code here
wants the shash_node itself, so it needs to use shash_find() instead.

This bug meant that any attempt to add a single netdev_vport to more than
one netdev_monitor would cause a segmentation fault.  Here's an example
command that reproduces it reliably for me under valgrind (because ofproto
always monitors its ports and the bridge monitors bond interfaces):

ovs-vsctl -- add-bond br0 bond0 p0 p1 \
          -- set interface p0 type=patch options:peer=p1 \
          -- set interface p1 type=patch options:peer=p0

Bug #4527.
Reported-by: Krishna Miriyala <krishna@nicira.com>

diff --git a/lib/netdev-vport.c b/lib/netdev-vport.c
index ae043c266a8df9bc2d6c2c3060bf9a37d4409a86..c6d4db89eeccb64c3d7692918683b41c7d761829 100644 (file)
--- a/lib/netdev-vport.c
+++ b/lib/netdev-vport.c
@@ -502,7 +502,7 @@ netdev_vport_poll_add(struct netdev *netdev,
     struct list *list;
     struct shash_node *shash_node;
 
-    shash_node = shash_find_data(&netdev_vport_notifiers, poll_name);
+    shash_node = shash_find(&netdev_vport_notifiers, poll_name);
     if (!shash_node) {
         list = xmalloc(sizeof *list);
         list_init(list);