From 95c5267ea1ae4006716529ea7f28299a5c99a9cc Mon Sep 17 00:00:00 2001 From: Florin Coras Date: Thu, 18 Apr 2019 10:04:03 -0700 Subject: vlib epoll: protect against clib file pool expansion Change-Id: I320e7c2fdacb3056bc448c73fec08d9e2978ee5e Signed-off-by: Florin Coras (cherry picked from commit c67078e007c8a9b91def387ba345efa805e45fc5) (cherry picked from commit fd2cd9c8993d646d025e05f18f36c9fc22776eb8) --- src/vlib/unix/input.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/vlib/unix/input.c b/src/vlib/unix/input.c index c6ebb997df4..370e5dddaf6 100644 --- a/src/vlib/unix/input.c +++ b/src/vlib/unix/input.c @@ -247,7 +247,7 @@ linux_epoll_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node, for (e = em->epoll_events; e < em->epoll_events + n_fds_ready; e++) { u32 i = e->data.u32; - clib_file_t *f = fm->file_pool + i; + clib_file_t *f = pool_elt_at_index (fm->file_pool, i); clib_error_t *errors[4]; int n_errors = 0; @@ -286,6 +286,10 @@ linux_epoll_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node, { f->read_events++; errors[n_errors] = f->read_function (f); + /* Make sure f is valid if the file pool moves */ + if (pool_is_free_index (fm->file_pool, i)) + continue; + f = pool_elt_at_index (fm->file_pool, i); n_errors += errors[n_errors] != 0; } if (e->events & EPOLLOUT) -- cgit 1.2.3-korg