ofproto: Fix duplicate hmap_remove() in ofproto_destroy().

Both ofport_destroy() and its caller ofproto_destroy() were attempting to
remove the ofport's hmap_node from the ofproto's 'ports' hmap, resulting
in a use-after-free error.

Reported-by: Michael MAO <mmao@nicira.com>

diff --git a/ofproto/ofproto.c b/ofproto/ofproto.c
index bfcae57a1b27aa89b67832e816aaff5a3663fa22..f21731011c58cedfdde37f2719d0ba58f07202ad 100644 (file)
--- a/ofproto/ofproto.c
+++ b/ofproto/ofproto.c
@@ -624,7 +624,6 @@ ofproto_destroy(struct ofproto *p)
 
     ofproto_flush_flows__(p);
     HMAP_FOR_EACH_SAFE (ofport, next_ofport, hmap_node, &p->ports) {
-        hmap_remove(&p->ports, &ofport->hmap_node);
         ofport_destroy(ofport);
     }