Fix use-after-free error.
authorBen Pfaff <blp@nicira.com>
Mon, 6 Oct 2008 23:25:56 +0000 (16:25 -0700)
committerBen Pfaff <blp@nicira.com>
Thu, 9 Oct 2008 22:53:05 +0000 (15:53 -0700)
rconn_destroy() decrements the n_queued counters that are set up by
rconn_send(), so we need to destroy the rconn before we destroy anything
that used it.

(This system is more error-prone than I imagined.)

controller/controller.c

index dcffee44e3b7adf459e9bf793607a69f6b61501f..ff3f8cf3a89ba82e62f195706ffcb305e7c05bf3 100644 (file)
@@ -174,8 +174,8 @@ main(int argc, char *argv[])
                     }
                     i++;
                 } else {
-                    lswitch_destroy(this->lswitch);
                     rconn_destroy(this->rconn);
+                    lswitch_destroy(this->lswitch);
                     switches[i] = switches[--n_switches];
                 }
             }