vlib epoll: protect against clib file pool expansion 93/19293/2
authorFlorin Coras <fcoras@cisco.com>
Thu, 18 Apr 2019 17:04:03 +0000 (10:04 -0700)
committerFlorin Coras <fcoras@cisco.com>
Wed, 1 May 2019 17:01:09 +0000 (10:01 -0700)
Change-Id: I320e7c2fdacb3056bc448c73fec08d9e2978ee5e
Signed-off-by: Florin Coras <fcoras@cisco.com>
(cherry picked from commit c67078e007c8a9b91def387ba345efa805e45fc5)
(cherry picked from commit fd2cd9c8993d646d025e05f18f36c9fc22776eb8)

src/vlib/unix/input.c

index c6ebb99..370e5dd 100644 (file)
@@ -247,7 +247,7 @@ linux_epoll_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
   for (e = em->epoll_events; e < em->epoll_events + n_fds_ready; e++)
     {
       u32 i = e->data.u32;
-      clib_file_t *f = fm->file_pool + i;
+      clib_file_t *f = pool_elt_at_index (fm->file_pool, i);
       clib_error_t *errors[4];
       int n_errors = 0;
 
@@ -286,6 +286,10 @@ linux_epoll_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
            {
              f->read_events++;
              errors[n_errors] = f->read_function (f);
+             /* Make sure f is valid if the file pool moves */
+             if (pool_is_free_index (fm->file_pool, i))
+               continue;
+             f = pool_elt_at_index (fm->file_pool, i);
              n_errors += errors[n_errors] != 0;
            }
          if (e->events & EPOLLOUT)