From: Aaron Campbell <aaron@arbor.net>
Date: Thu, 26 Jun 2014 14:54:34 +0000 (-0400)
Subject: eal: fix invalid memory read
X-Git-Tag: spdx-start~10575
X-Git-Url: http://git.droids-corp.org/?a=commitdiff_plain;h=b024956a239a199c31b2171095ed505c840df32a;p=dpdk.git

eal: fix invalid memory read

Valgrind reports this issue:

==29880== Invalid read of size 1
==29880==    at 0x56FF9A5: cpu_socket_id (eal_lcore.c:101)
==29880==    by 0x56FFAE9: rte_eal_cpu_init (eal_lcore.c:168)
==29880==    by 0x56F944A: rte_eal_init (eal.c:975)

The problem is that endptr points to memory allocated underneath the DIR
handle, which has already been freed. So move the closedir() call lower.

Signed-off-by: Aaron Campbell <aaron@arbor.net>
Acked-by: Thomas Monjalon <thomas.monjalon@6wind.com>
---

diff --git a/lib/librte_eal/linuxapp/eal/eal_lcore.c b/lib/librte_eal/linuxapp/eal/eal_lcore.c
index baf16598ae..c67e0e68db 100644
--- a/lib/librte_eal/linuxapp/eal/eal_lcore.c
+++ b/lib/librte_eal/linuxapp/eal/eal_lcore.c
@@ -77,7 +77,7 @@ cpu_socket_id(unsigned lcore_id)
 	const char node_prefix[] = "node";
 	const size_t prefix_len = sizeof(node_prefix) - 1;
 	char path[PATH_MAX];
-	DIR *d;
+	DIR *d = NULL;
 	unsigned long id = 0;
 	struct dirent *e;
 	char *endptr = NULL;
@@ -97,7 +97,6 @@ cpu_socket_id(unsigned lcore_id)
 			break;
 		}
 	}
-	closedir(d);
 	if (endptr == NULL || *endptr!='\0' || endptr == e->d_name+prefix_len) {
 		RTE_LOG(WARNING, EAL, "Cannot read numa node link "
 				"for lcore %u - using physical package id instead\n",
@@ -110,9 +109,12 @@ cpu_socket_id(unsigned lcore_id)
 		if (eal_parse_sysfs_value(path, &id) != 0)
 			goto err;
 	}
+	closedir(d);
 	return (unsigned)id;
 
 err:
+	if (d)
+		closedir(d);
 	RTE_LOG(ERR, EAL, "Error getting NUMA socket information from %s "
 			"for lcore %u - assuming NUMA socket 0\n", SYS_CPU_DIR, lcore_id);
 	return 0;