datapath: Acquire dp->mutex when deleting a datapath.

It's possible that someone is using the datapath data structures
when we attempt to delete the datapath.  The first writer will
only hold dp->mutex, which we don't currently acquire when deleting.
This adds that lock to prevent a potential race (this can't currently
happen because userspace is single threaded, as long as "ovs-dpctl
del-dp" is not used at the same time).

Signed-off-by: Jesse Gross <jesse@nicira.com>
Acked-by: Ben Pfaff <blp@nicira.com>

diff --git a/datapath/datapath.c b/datapath/datapath.c
index 87b2a0588cbaf7c16e7999e0935c75b4f0083c07..1bf052061367f723db7865e8b01d3da2492fb56d 100644 (file)
--- a/datapath/datapath.c
+++ b/datapath/datapath.c
@@ -318,9 +318,11 @@ static int destroy_dp(int dp_idx)
        dp = get_dp(dp_idx);
        if (!dp) {
                err = -ENODEV;
-               goto unlock;
+               goto out;
        }
 
+       mutex_lock(&dp->mutex);
+
        list_for_each_entry_safe (p, n, &dp->port_list, node)
                if (p->port_no != ODPP_LOCAL)
                        dp_detach_port(p);
@@ -336,10 +338,11 @@ static int destroy_dp(int dp_idx)
                skb_queue_purge(&dp->queues[i]);
        free_percpu(dp->stats_percpu);
 
+       mutex_unlock(&dp->mutex);
        kobject_put(&dp->ifobj);
        module_put(THIS_MODULE);
 
-unlock:
+out:
        mutex_unlock(&dp_mutex);
        rtnl_unlock();
        return err;