diff options
| author |   Steven <sluong@cisco.com> | 2017-09-07 09:20:56 -0700 |
|---|---|---|
| committer |   Dave Barach <openvpp@barachs.net> | 2017-09-08 12:46:10 +0000 |
| commit | d6042d4f1ea0baf02bc87c72960a331a9e08dfab (patch) | |
| tree | f0480a1ef95accb785a491c3b88505800932822f /src/plugins/memif/device.c | |
| parent | 932f74196d9571fd007cef32c234bd00ab75975e (diff) | |
memif: fix coverity warnings as of 9/7
1. coverity complains about "buffer not null terminated" for strncpy because we
pass the size of the destination to the call which is equal to the true size
of the destination. We subtract 1 for the size to accommodate the null like all
other places are already doing it.
2. Add a check to tx_queues in memif_interface_tx_inline to avoid "divide by zero".
3. To avoid null pointer dereference in memif_create_if, change the goto done
rather than goto error and spit a more meaningful error rather than silent about it.
4. Shuffle a line to avoid "check after use" in vl_api_memif_delete_t_handler.
Change-Id: Icba7ecd5362c012a48ac35795d31aab356617420
Signed-off-by: Steven <sluong@cisco.com>
Diffstat (limited to 'src/plugins/memif/device.c')
| -rw-r--r-- | src/plugins/memif/device.c | 14 |
1 files changed, 12 insertions, 2 deletions
diff --git a/src/plugins/memif/device.c b/src/plugins/memif/device.c index c76825349f3..aff18f2df6b 100644 --- a/src/plugins/memif/device.c +++ b/src/plugins/memif/device.c @@ -31,7 +31,8 @@ #define foreach_memif_tx_func_error \ _(NO_FREE_SLOTS, "no free tx slots") \ _(TRUNC_PACKET, "packet > buffer size -- truncated in tx ring") \ -_(PENDING_MSGS, "pending msgs in tx ring") +_(PENDING_MSGS, "pending msgs in tx ring") \ +_(NO_TX_QUEUES, "no tx queues") typedef enum { @@ -169,6 +170,13 @@ memif_interface_tx_inline (vlib_main_t * vm, vlib_node_runtime_t * node, u8 tx_queues = vec_len (mif->tx_queues); memif_queue_t *mq; + if (PREDICT_FALSE (tx_queues == 0)) + { + vlib_error_count (vm, node->node_index, MEMIF_TX_ERROR_NO_TX_QUEUES, + n_left); + goto error; + } + if (tx_queues < vec_len (vlib_mains)) { qid = thread_index % tx_queues; @@ -249,7 +257,6 @@ memif_interface_tx_inline (vlib_main_t * vm, vlib_node_runtime_t * node, n_left); } - vlib_buffer_free (vm, vlib_frame_args (frame), frame->n_vectors); if ((ring->flags & MEMIF_RING_FLAG_MASK_INT) == 0 && mq->int_fd > -1) { u64 b = 1; @@ -257,6 +264,9 @@ memif_interface_tx_inline (vlib_main_t * vm, vlib_node_runtime_t * node, mq->int_count++; } +error: + vlib_buffer_free (vm, vlib_frame_args (frame), frame->n_vectors); + return frame->n_vectors; } |