libmemif: fix possible segfault on memif_get_details

[vpp.git] / extras / libmemif / src / main.c

diff --git a/extras/libmemif/src/main.c b/extras/libmemif/src/main.c
index 782442d..ab7a2f0 100644 (file)
--- a/extras/libmemif/src/main.c
+++ b/extras/libmemif/src/main.c
@@ -632,7 +632,7 @@ memif_create (memif_conn_handle_t * c, memif_conn_args_t * args,
              memif_interrupt_t * on_interrupt, void *private_ctx)
 {
   libmemif_main_t *lm = &libmemif_main;
-  int err, i, index, sockfd = -1;
+  int err, i, index = 0, sockfd = -1;
   memif_list_elt_t list_elt;
   memif_connection_t *conn = (memif_connection_t *) * c;
   if (conn != NULL)
@@ -892,7 +892,7 @@ error:
 int
 memif_control_fd_handler (int fd, uint8_t events)
 {
-  int i, rv, sockfd = -1, err = MEMIF_ERR_SUCCESS;     /* 0 */
+  int i, sockfd = -1, err = MEMIF_ERR_SUCCESS; /* 0 */
   uint16_t num;
   memif_list_elt_t *e = NULL;
   memif_connection_t *conn;
@@ -902,6 +902,10 @@ memif_control_fd_handler (int fd, uint8_t events)
       uint64_t b;
       ssize_t size;
       size = read (fd, &b, sizeof (b));
+
+      if (size == -1)
+        goto error;
+
       for (i = 0; i < lm->control_list_len; i++)
        {
          if ((lm->control_list[i].key < 0)
@@ -1042,11 +1046,8 @@ error:
 int
 memif_poll_event (int timeout)
 {
-  libmemif_main_t *lm = &libmemif_main;
-  memif_list_elt_t *elt;
-  struct epoll_event evt, *e;
-  int en = 0, err = MEMIF_ERR_SUCCESS, i = 0;  /* 0 */
-  uint16_t num;
+  struct epoll_event evt;
+  int en = 0, err = MEMIF_ERR_SUCCESS; /* 0 */
   uint32_t events = 0;
   uint64_t counter = 0;
   ssize_t r = 0;
@@ -1066,6 +1067,9 @@ memif_poll_event (int timeout)
       if (evt.data.fd == poll_cancel_fd)
        {
          r = read (evt.data.fd, &counter, sizeof (counter));
+         if (r == -1)
+           return MEMIF_ERR_DISCONNECTED;
+
          return MEMIF_ERR_POLL_CANCEL;
        }
       if (evt.events & EPOLLIN)
@@ -1308,7 +1312,6 @@ memif_connect1 (memif_connection_t * c)
   memif_region_t *mr;
   memif_queue_t *mq;
   int i;
-  uint16_t num;
 
   for (i = 0; i < c->regions_num; i++)
     {
@@ -1530,11 +1533,8 @@ memif_init_queues (libmemif_main_t * lm, memif_connection_t * conn)
 int
 memif_init_regions_and_queues (memif_connection_t * conn)
 {
-  memif_ring_t *ring = NULL;
   memif_region_t *r;
-  int i, j;
   libmemif_main_t *lm = &libmemif_main;
-  memif_list_elt_t e;
 
   /* region 0. rings */
   memif_add_region (lm, conn, /* has_buffers */ 0);
@@ -1595,7 +1595,7 @@ memif_buffer_enq_tx (memif_conn_handle_t conn, uint16_t qid,
   uint16_t mask = (1 << mq->log2_ring_size) - 1;
   uint16_t ring_size;
   uint16_t slot, ns;
-  int i, err = MEMIF_ERR_SUCCESS;      /* 0 */
+  int err = MEMIF_ERR_SUCCESS; /* 0 */
   *count_out = 0;
 
   ring_size = (1 << mq->log2_ring_size);
@@ -1645,7 +1645,6 @@ memif_buffer_enq_tx (memif_conn_handle_t conn, uint16_t qid,
       err = MEMIF_ERR_NOBUF_RING;
     }
 
-error:
   return err;
 }
 
@@ -1670,12 +1669,12 @@ memif_buffer_alloc (memif_conn_handle_t conn, uint16_t qid,
   libmemif_main_t *lm = &libmemif_main;
   memif_queue_t *mq = &c->tx_queues[qid];
   memif_ring_t *ring = mq->ring;
-  memif_buffer_t *b0, *b1;
+  memif_buffer_t *b0;
   uint16_t mask = (1 << mq->log2_ring_size) - 1;
   uint32_t offset_mask = c->run_args.buffer_size - 1;
   uint16_t ring_size;
   uint16_t slot, ns;
-  int i, err = MEMIF_ERR_SUCCESS;      /* 0 */
+  int err = MEMIF_ERR_SUCCESS; /* 0 */
   uint16_t dst_left, src_left;
   uint16_t saved_count;
   memif_buffer_t *saved_b;
@@ -1772,7 +1771,6 @@ no_ns:
       err = MEMIF_ERR_NOBUF_RING;
     }
 
-error:
   return err;
 }
 
@@ -1919,7 +1917,7 @@ memif_rx_burst (memif_conn_handle_t conn, uint16_t qid,
   uint16_t cur_slot, last_slot;
   uint16_t ns;
   uint16_t mask = (1 << mq->log2_ring_size) - 1;
-  memif_buffer_t *b0, *b1;
+  memif_buffer_t *b0;
   *rx = 0;
 
   uint64_t b;
@@ -1992,7 +1990,7 @@ memif_get_details (memif_conn_handle_t conn, memif_details_t * md,
     return MEMIF_ERR_NOCONN;
 
   int err = MEMIF_ERR_SUCCESS, i;
-  ssize_t l0, l1, total_l;
+  ssize_t l0, l1;
   l0 = 0;
 
   l1 = strlen ((char *) c->args.interface_name);
@@ -2076,20 +2074,19 @@ memif_get_details (memif_conn_handle_t conn, memif_details_t * md,
   if (l0 + l1 <= buflen)
     {
       md->regions = (memif_region_details_t *) buf + l0;
+      for (i = 0; i < md->regions_num; i++)
+        {
+          md->regions[i].index = i;
+          md->regions[i].addr = c->regions[i].addr;
+          md->regions[i].size = c->regions[i].region_size;
+          md->regions[i].fd = c->regions[i].fd;
+          md->regions[i].is_external = c->regions[i].is_external;
+        }
       l0 += l1;
     }
   else
     err = MEMIF_ERR_NOBUF_DET;
 
-  for (i = 0; i < md->regions_num; i++)
-    {
-      md->regions[i].index = i;
-      md->regions[i].addr = c->regions[i].addr;
-      md->regions[i].size = c->regions[i].region_size;
-      md->regions[i].fd = c->regions[i].fd;
-      md->regions[i].is_external = c->regions[i].is_external;
-    }
-
   md->rx_queues_num =
     (c->args.is_master) ? c->run_args.num_s2m_rings : c->
     run_args.num_m2s_rings;
@@ -2098,22 +2095,21 @@ memif_get_details (memif_conn_handle_t conn, memif_details_t * md,
   if (l0 + l1 <= buflen)
     {
       md->rx_queues = (memif_queue_details_t *) buf + l0;
+      for (i = 0; i < md->rx_queues_num; i++)
+        {
+          md->rx_queues[i].region = c->rx_queues[i].region;
+          md->rx_queues[i].qid = i;
+          md->rx_queues[i].ring_size = (1 << c->rx_queues[i].log2_ring_size);
+          md->rx_queues[i].flags = c->rx_queues[i].ring->flags;
+          md->rx_queues[i].head = c->rx_queues[i].ring->head;
+          md->rx_queues[i].tail = c->rx_queues[i].ring->tail;
+          md->rx_queues[i].buffer_size = c->run_args.buffer_size;
+        }
       l0 += l1;
     }
   else
     err = MEMIF_ERR_NOBUF_DET;
 
-  for (i = 0; i < md->rx_queues_num; i++)
-    {
-      md->rx_queues[i].region = c->rx_queues[i].region;
-      md->rx_queues[i].qid = i;
-      md->rx_queues[i].ring_size = (1 << c->rx_queues[i].log2_ring_size);
-      md->rx_queues[i].flags = c->rx_queues[i].ring->flags;
-      md->rx_queues[i].head = c->rx_queues[i].ring->head;
-      md->rx_queues[i].tail = c->rx_queues[i].ring->tail;
-      md->rx_queues[i].buffer_size = c->run_args.buffer_size;
-    }
-
   md->tx_queues_num =
     (c->args.is_master) ? c->run_args.num_m2s_rings : c->
     run_args.num_s2m_rings;
@@ -2122,22 +2118,21 @@ memif_get_details (memif_conn_handle_t conn, memif_details_t * md,
   if (l0 + l1 <= buflen)
     {
       md->tx_queues = (memif_queue_details_t *) buf + l0;
+      for (i = 0; i < md->tx_queues_num; i++)
+        {
+          md->tx_queues[i].region = c->tx_queues[i].region;
+          md->tx_queues[i].qid = i;
+          md->tx_queues[i].ring_size = (1 << c->tx_queues[i].log2_ring_size);
+          md->tx_queues[i].flags = c->tx_queues[i].ring->flags;
+          md->tx_queues[i].head = c->tx_queues[i].ring->head;
+          md->tx_queues[i].tail = c->tx_queues[i].ring->tail;
+          md->tx_queues[i].buffer_size = c->run_args.buffer_size;
+        }
       l0 += l1;
     }
   else
     err = MEMIF_ERR_NOBUF_DET;
 
-  for (i = 0; i < md->tx_queues_num; i++)
-    {
-      md->tx_queues[i].region = c->tx_queues[i].region;
-      md->tx_queues[i].qid = i;
-      md->tx_queues[i].ring_size = (1 << c->tx_queues[i].log2_ring_size);
-      md->tx_queues[i].flags = c->tx_queues[i].ring->flags;
-      md->tx_queues[i].head = c->tx_queues[i].ring->head;
-      md->tx_queues[i].tail = c->tx_queues[i].ring->tail;
-      md->tx_queues[i].buffer_size = c->run_args.buffer_size;
-    }
-
   md->link_up_down = (c->fd > 0) ? 1 : 0;
 
   return err;                  /* 0 */