Fix double free in af_packet api/cli

The api was allocating a vector for the name, passing it, then freeing
it, on create. The cli allocated, passed then forgot about it.

af_packet_create_if was storing a reference to the name, which in the
case of the api, meant it was referencing dead memory. On
af_packet_delete_if this reference was freed, so in the api case, there
was a double free.

Also, the cli for delete leaked the name.

Change-Id: I4d572bd2936eaf8ea7a0a8ff282e83ac2bf1b062
Signed-off-by: Ivan Kelly <ivan@midokura.com>

1 files changed, 2 insertions, 0 deletions

diff --git a/vnet/vnet/devices/af_packet/cli.c b/vnet/vnet/devices/af_packet/cli.c
index 87ec5182c74..2cbd415289e 100644
--- a/vnet/vnet/devices/af_packet/cli.c
+++ b/vnet/vnet/devices/af_packet/cli.c
@@ -65,6 +65,7 @@ af_packet_create_command_fn (vlib_main_t * vm, unformat_input_t * input,
     return clib_error_return (0, "missing host interface name");
 
   r = af_packet_create_if (vm, host_if_name, hw_addr_ptr, &sw_if_index);
+  vec_free (host_if_name);
 
   if (r == VNET_API_ERROR_SYSCALL_ERROR_1)
     return clib_error_return (0, "%s (errno %d)", strerror (errno), errno);
@@ -113,6 +114,7 @@ af_packet_delete_command_fn (vlib_main_t * vm, unformat_input_t * input,
     return clib_error_return (0, "missing host interface name");
 
   af_packet_delete_if (vm, host_if_name);
+  vec_free (host_if_name);
 
   return 0;
 }