In the case where the learned flow limit has been reached (below_limit == false), ofproto_flow_mod_uninit() would unref ofm->temp_rule (which is also in the 'rule' local variable) before dereferencing rule->flow_cookie for the log message. This fixes the problem.
(The greatest likely consequence of this bug was logging the wrong cookie value.) Signed-off-by: Ben Pfaff <b...@ovn.org> --- ofproto/ofproto.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/ofproto/ofproto.c b/ofproto/ofproto.c index 76d96a6f93f3..1b80a327ac18 100644 --- a/ofproto/ofproto.c +++ b/ofproto/ofproto.c @@ -5141,15 +5141,13 @@ ofproto_flow_mod_learn(struct ofproto_flow_mod *ofm, bool keep_ref, ofproto_flow_mod_learn_finish(ofm, NULL); } } else { + static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(1, 5); + VLOG_INFO_RL(&rl, "Learn limit for flow %"PRIu64" reached.", + rule->flow_cookie); + ofproto_flow_mod_uninit(ofm); } ovs_mutex_unlock(&ofproto_mutex); - - if (!below_limit) { - static struct vlog_rate_limit learn_rl = VLOG_RATE_LIMIT_INIT(1, 5); - VLOG_INFO_RL(&learn_rl, "Learn limit for flow %"PRIu64" reached.", - rule->flow_cookie); - } } if (!keep_ref && below_limit) { -- 2.10.2 _______________________________________________ dev mailing list d...@openvswitch.org https://mail.openvswitch.org/mailman/listinfo/ovs-dev