Fix memory corruption faulting [VPP-1639] 52/19052/2
authorArtem Belov <artem.belov@xored.com>
Thu, 18 Apr 2019 07:30:43 +0000 (07:30 +0000)
committerAndrew Yourtchenko <ayourtch@gmail.com>
Fri, 19 Apr 2019 12:17:05 +0000 (12:17 +0000)
File pool may be reallocated on epoll events processing.
*f* pointer shows to already freed address and corrupting
memory chunk on clib_file_t property change.

Change-Id: I751bddce27325452862b939c1a3eec2ccd9b71bb
Signed-off-by: Artem Belov <artem.belov@xored.com>
(cherry picked from commit 32b07c31876ece35cff1b9ab99a74a631a88e35a)

src/vlib/unix/input.c

index 8be0770..c6ebb99 100644 (file)
@@ -284,14 +284,14 @@ linux_epoll_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
        {
          if (e->events & EPOLLIN)
            {
-             errors[n_errors] = f->read_function (f);
              f->read_events++;
+             errors[n_errors] = f->read_function (f);
              n_errors += errors[n_errors] != 0;
            }
          if (e->events & EPOLLOUT)
            {
-             errors[n_errors] = f->write_function (f);
              f->write_events++;
+             errors[n_errors] = f->write_function (f);
              n_errors += errors[n_errors] != 0;
            }
        }
@@ -299,8 +299,8 @@ linux_epoll_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
        {
          if (f->error_function)
            {
-             errors[n_errors] = f->error_function (f);
              f->error_events++;
+             errors[n_errors] = f->error_function (f);
              n_errors += errors[n_errors] != 0;
            }
          else