[ovs-dev] [crashes 1/3] ofproto: Fix order of destruction in ofproto_destroy().

[Ben Pfaff]

ofproto_flush_flows() calls into the connmgr (via connmgr_flushed()) so
it must be called before destroying the connmgr to avoid a use-after-free
error.

Bug #5231.
Reported-by: Krishna Miriyala <krishna at nicira.com>
---
 ofproto/ofproto.c |    4 +---
 1 files changed, 1 insertions(+), 3 deletions(-)

diff --git a/ofproto/ofproto.c b/ofproto/ofproto.c
index 6994b11..7cdc98a 100644
--- a/ofproto/ofproto.c
+++ b/ofproto/ofproto.c
@@ -683,10 +683,8 @@ ofproto_destroy(struct ofproto *p)
 
     shash_find_and_delete(&all_ofprotos, dpif_name(p->dpif));
 
-    /* Destroy connmgr early, since it touches the classifier. */
-    connmgr_destroy(p->connmgr);
-
     ofproto_flush_flows(p);
+    connmgr_destroy(p->connmgr);
     classifier_destroy(&p->cls);
     hmap_destroy(&p->facets);
 
-- 
1.7.1