From 8dd5089e2ba60908864931cbbbcad7d281e24d34 Mon Sep 17 00:00:00 2001 From: Ben Pfaff Date: Thu, 12 May 2011 12:21:23 -0700 Subject: [PATCH] ofproto: Fix duplicate hmap_remove() in ofproto_destroy(). Both ofport_destroy() and its caller ofproto_destroy() were attempting to remove the ofport's hmap_node from the ofproto's 'ports' hmap, resulting in a use-after-free error. Reported-by: Michael MAO --- ofproto/ofproto.c | 1 - 1 file changed, 1 deletion(-) diff --git a/ofproto/ofproto.c b/ofproto/ofproto.c index bfcae57a..f2173101 100644 --- a/ofproto/ofproto.c +++ b/ofproto/ofproto.c @@ -624,7 +624,6 @@ ofproto_destroy(struct ofproto *p) ofproto_flush_flows__(p); HMAP_FOR_EACH_SAFE (ofport, next_ofport, hmap_node, &p->ports) { - hmap_remove(&p->ports, &ofport->hmap_node); ofport_destroy(ofport); } -- 2.30.2