4 files changed, 29 insertions, 12 deletions

diff --git a/src/plugins/memif/device.c b/src/plugins/memif/device.c
index c76825349f3..aff18f2df6b 100644
--- a/src/plugins/memif/device.c
+++ b/src/plugins/memif/device.c
@@ -31,7 +31,8 @@
 #define foreach_memif_tx_func_error	       \
 _(NO_FREE_SLOTS, "no free tx slots")           \
 _(TRUNC_PACKET, "packet > buffer size -- truncated in tx ring") \
-_(PENDING_MSGS, "pending msgs in tx ring")
+_(PENDING_MSGS, "pending msgs in tx ring") \
+_(NO_TX_QUEUES, "no tx queues")
 
 typedef enum
 {
@@ -169,6 +170,13 @@ memif_interface_tx_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
   u8 tx_queues = vec_len (mif->tx_queues);
   memif_queue_t *mq;
 
+  if (PREDICT_FALSE (tx_queues == 0))
+    {
+      vlib_error_count (vm, node->node_index, MEMIF_TX_ERROR_NO_TX_QUEUES,
+			n_left);
+      goto error;
+    }
+
   if (tx_queues < vec_len (vlib_mains))
     {
       qid = thread_index % tx_queues;
@@ -249,7 +257,6 @@ memif_interface_tx_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
 			n_left);
     }
 
-  vlib_buffer_free (vm, vlib_frame_args (frame), frame->n_vectors);
   if ((ring->flags & MEMIF_RING_FLAG_MASK_INT) == 0 && mq->int_fd > -1)
     {
       u64 b = 1;
@@ -257,6 +264,9 @@ memif_interface_tx_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
       mq->int_count++;
     }
 
+error:
+  vlib_buffer_free (vm, vlib_frame_args (frame), frame->n_vectors);
+
   return frame->n_vectors;
 }
 
diff --git a/src/plugins/memif/memif.c b/src/plugins/memif/memif.c
index af81faf2711..7e2d947f426 100644
--- a/src/plugins/memif/memif.c
+++ b/src/plugins/memif/memif.c
@@ -611,8 +611,11 @@ memif_create_if (vlib_main_t * vm, memif_create_if_args_t * args)
 	    }
 	  else
 	    {
-	      ret = VNET_API_ERROR_SYSCALL_ERROR_3;
-	      goto error;
+	      error = clib_error_return (0, "File exists for %s",
+					 socket_filename);
+	      clib_error_report (error);
+	      rv = VNET_API_ERROR_VALUE_EXIST;
+	      goto done;
 	    }
 	}
       pool_get (mm->socket_files, msf);
diff --git a/src/plugins/memif/memif_api.c b/src/plugins/memif/memif_api.c
index 2b7b792ae20..89afdb8d681 100644
--- a/src/plugins/memif/memif_api.c
+++ b/src/plugins/memif/memif_api.c
@@ -201,13 +201,16 @@ vl_api_memif_delete_t_handler (vl_api_memif_delete_t * mp)
   vl_api_memif_delete_reply_t *rmp;
   vnet_hw_interface_t *hi =
     vnet_get_sup_hw_interface (vnm, ntohl (mp->sw_if_index));
-  memif_if_t *mif = pool_elt_at_index (mm->interfaces, hi->dev_instance);
+  memif_if_t *mif;
   int rv = 0;
 
   if (hi == NULL || memif_device_class.index != hi->dev_class_index)
     rv = VNET_API_ERROR_INVALID_SW_IF_INDEX;
   else
-    rv = memif_delete_if (vm, mif);
+    {
+      mif = pool_elt_at_index (mm->interfaces, hi->dev_instance);
+      rv = memif_delete_if (vm, mif);
+    }
 
   REPLY_MACRO (VL_API_MEMIF_DELETE_REPLY);
 }
diff --git a/src/plugins/memif/socket.c b/src/plugins/memif/socket.c
index a3c8d544b7d..79ae07bef15 100644
--- a/src/plugins/memif/socket.c
+++ b/src/plugins/memif/socket.c
@@ -115,7 +115,7 @@ memif_msg_enq_hello (int fd)
   h->max_region = MEMIF_MAX_REGION;
   h->max_log2_ring_size = MEMIF_MAX_LOG2_RING_SIZE;
   s = format (0, "VPP %s%c", VPP_BUILD_VER, 0);
-  strncpy ((char *) h->name, (char *) s, sizeof (h->name));
+  strncpy ((char *) h->name, (char *) s, sizeof (h->name) - 1);
   vec_free (s);
   return memif_msg_send (fd, &msg, -1);
 }
@@ -134,9 +134,10 @@ memif_msg_enq_init (memif_if_t * mif)
   i->id = mif->id;
   i->mode = mif->mode;
   s = format (0, "VPP %s%c", VPP_BUILD_VER, 0);
-  strncpy ((char *) i->name, (char *) s, sizeof (i->name));
+  strncpy ((char *) i->name, (char *) s, sizeof (i->name) - 1);
   if (mif->secret)
-    strncpy ((char *) i->secret, (char *) mif->secret, sizeof (i->secret));
+    strncpy ((char *) i->secret, (char *) mif->secret,
+	     sizeof (i->secret) - 1);
   vec_free (s);
 }
 
@@ -189,7 +190,7 @@ memif_msg_enq_connect (memif_if_t * mif)
   e->msg.type = MEMIF_MSG_TYPE_CONNECT;
   e->fd = -1;
   s = format (0, "%U%c", format_memif_device_name, mif->dev_instance, 0);
-  strncpy ((char *) c->if_name, (char *) s, sizeof (c->if_name));
+  strncpy ((char *) c->if_name, (char *) s, sizeof (c->if_name) - 1);
   vec_free (s);
 }
 
@@ -204,7 +205,7 @@ memif_msg_enq_connected (memif_if_t * mif)
   e->msg.type = MEMIF_MSG_TYPE_CONNECTED;
   e->fd = -1;
   s = format (0, "%U%c", format_memif_device_name, mif->dev_instance, 0);
-  strncpy ((char *) c->if_name, (char *) s, sizeof (c->if_name));
+  strncpy ((char *) c->if_name, (char *) s, sizeof (c->if_name) - 1);
   vec_free (s);
 }
 
@@ -216,7 +217,7 @@ memif_msg_send_disconnect (memif_if_t * mif, clib_error_t * err)
   memif_msg_disconnect_t *d = &msg.disconnect;
 
   d->code = err->code;
-  strncpy ((char *) d->string, (char *) err->what, sizeof (d->string));
+  strncpy ((char *) d->string, (char *) err->what, sizeof (d->string) - 1);
 
   return memif_msg_send (mif->conn_fd, &msg, -1);
 }