From: Ben Pfaff <blp@nicira.com>
Date: Thu, 12 May 2011 19:21:23 +0000 (-0700)
Subject: ofproto: Fix duplicate hmap_remove() in ofproto_destroy().
X-Git-Url: https://pintos-os.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8dd5089e2ba60908864931cbbbcad7d281e24d34;p=openvswitch

ofproto: Fix duplicate hmap_remove() in ofproto_destroy().

Both ofport_destroy() and its caller ofproto_destroy() were attempting to
remove the ofport's hmap_node from the ofproto's 'ports' hmap, resulting
in a use-after-free error.

Reported-by: Michael MAO <mmao@nicira.com>
---

diff --git a/ofproto/ofproto.c b/ofproto/ofproto.c
index bfcae57a..f2173101 100644
--- a/ofproto/ofproto.c
+++ b/ofproto/ofproto.c
@@ -624,7 +624,6 @@ ofproto_destroy(struct ofproto *p)
 
     ofproto_flush_flows__(p);
     HMAP_FOR_EACH_SAFE (ofport, next_ofport, hmap_node, &p->ports) {
-        hmap_remove(&p->ports, &ofport->hmap_node);
         ofport_destroy(ofport);
     }