diff options
| author |   Dave Barach <dave@barachs.net> | 2018-08-06 08:43:47 -0400 |
|---|---|---|
| committer | Dave Barach <dave@barachs.net> | 2018-08-06 08:44:59 -0400 |
| commit | ca45ee73d7c49c7f659c5cd690d3403d440e50f9 (patch) | |
| tree | e047c615324718ec0c5341628ec7bb4ad8d668a3 /src/vppinfra/bihash_template.c | |
| parent | 466f289c27f290a2764a82f57f5c20d080227ead (diff) | |
fix dangling reference in foreach_key_value_pair
When the user deletes the last entry in a bihash bucket, the bihash
infra frees the bucket's backing storage. If this happens under
clib_bihash_foreach_key_value_pair - and the freed bucket happens to
be the bucket being traversed - the resulting dangling reference can
easily make the wheels fall off.
Simple fix: if (bucket-is-now-empty) double-break.
Change-Id: Idc44247a82ed5d0ba548507b4a53d4c8503ba8bb
Signed-off-by: Dave Barach <dave@barachs.net>
Diffstat (limited to 'src/vppinfra/bihash_template.c')
| -rw-r--r-- | src/vppinfra/bihash_template.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/src/vppinfra/bihash_template.c b/src/vppinfra/bihash_template.c index 8a6fa16389b..41d7c7ce1d6 100644 --- a/src/vppinfra/bihash_template.c +++ b/src/vppinfra/bihash_template.c @@ -653,9 +653,16 @@ void BV (clib_bihash_foreach_key_value_pair) continue; (*fp) (&v->kvp[k], arg); + /* + * In case the callback deletes the last entry in the bucket... + */ + if (BV (clib_bihash_bucket_is_empty) (b)) + goto doublebreak; } v++; } + doublebreak: + ; } } |