dpif-netlink: Fix multiple-free and fd leak on error path.

This function attempts to open a bunch of new handlers.  If it fails, it
attempts to close all the handlers that have already been opened.
Unfortunately, the loop to close the opened handlers used the wrong array
index: 'i' instead of 'j'.  This fixes the problem.

Found by Coverity.

Reported-at: https://scan3.coverity.com/reports.htm#v16889/p10449/fileInstanceId=14762827&defectInstanceId=4305351&mergedDefectId=180429
Signed-off-by: Ben Pfaff <blp@ovn.org>
Acked-by: Justin Pettit <jpettit@ovn.org>

diff --git a/lib/dpif-netlink.c b/lib/dpif-netlink.c
index 503fe33eb161f6663c0cb4f5b96066ffe8beaf82..d53c38c59c7c14525601a2307918080f63c2f2f0 100644 (file)
--- a/lib/dpif-netlink.c
+++ b/lib/dpif-netlink.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008, 2009, 2010, 2011, 2012, 2013, 2014, 2015, 2016 Nicira, Inc.
+ * Copyright (c) 2008-2017 Nicira, Inc.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -1884,10 +1884,9 @@ dpif_netlink_refresh_channels(struct dpif_netlink *dpif, uint32_t n_handlers)
             error = dpif_netlink_handler_init(handler);
             if (error) {
                 size_t j;
-                struct dpif_handler *tmp = &dpif->handlers[i];
-
 
                 for (j = 0; j < i; j++) {
+                    struct dpif_handler *tmp = &dpif->handlers[j];
                     dpif_netlink_handler_uninit(tmp);
                 }
                 free(dpif->handlers);