[dpdk-dev] [PATCH] eal: fix invalid memory read as reported by valgrind

[dpdk-dev] [PATCH] eal: fix invalid memory read as reported by valgrind

[Aaron Campbell]

==29880== Invalid read of size 1
==29880==    at 0x56FF9A5: cpu_socket_id (eal_lcore.c:101)
==29880==    by 0x56FFAE9: rte_eal_cpu_init (eal_lcore.c:168)
==29880==    by 0x56F944A: rte_eal_init (eal.c:975)

The problem is that endptr points to memory allocated underneath the DIR
handle, which has already been freed.  So move the closedir() call lower.

Signed-off-by: Aaron Campbell <aaron@arbor.net>
---
 lib/librte_eal/linuxapp/eal/eal_lcore.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/lib/librte_eal/linuxapp/eal/eal_lcore.c b/lib/librte_eal/linuxapp/eal/eal_lcore.c
index cc9b900..fd11142 100644
--- a/lib/librte_eal/linuxapp/eal/eal_lcore.c
+++ b/lib/librte_eal/linuxapp/eal/eal_lcore.c
@@ -77,7 +77,7 @@ cpu_socket_id(unsigned lcore_id)
 	const char node_prefix[] = "node";
 	const size_t prefix_len = sizeof(node_prefix) - 1;
 	char path[PATH_MAX];
-	DIR *d;
+	DIR *d = NULL;
 	unsigned long id = 0;
 	struct dirent *e;
 	char *endptr = NULL;
@@ -97,7 +97,6 @@ cpu_socket_id(unsigned lcore_id)
 			break;
 		}
 	}
-	closedir(d);
 	if (endptr == NULL || *endptr!='\0' || endptr == e->d_name+prefix_len) {
 		RTE_LOG(WARNING, EAL, "Cannot read numa node link "
 				"for lcore %u - using physical package id instead\n",
@@ -110,9 +109,12 @@ cpu_socket_id(unsigned lcore_id)
 		if (eal_parse_sysfs_value(path, &id) != 0)
 			goto err;
 	}
+	closedir(d);
 	return (unsigned)id;
 
 err:
+	if (d)
+		closedir(d);
 	RTE_LOG(ERR, EAL, "Error getting NUMA socket information from %s "
 			"for lcore %u - assuming NUMA socket 0\n", SYS_CPU_DIR, lcore_id);
 	return 0;
-- 
1.8.3.2

Re: [dpdk-dev] [PATCH] eal: fix invalid memory read as reported by valgrind

[Thomas Monjalon]

2014-06-26 10:54, Aaron Campbell:
> ==29880== Invalid read of size 1
> ==29880==    at 0x56FF9A5: cpu_socket_id (eal_lcore.c:101)
> ==29880==    by 0x56FFAE9: rte_eal_cpu_init (eal_lcore.c:168)
> ==29880==    by 0x56F944A: rte_eal_init (eal.c:975)
> 
> The problem is that endptr points to memory allocated underneath the DIR
> handle, which has already been freed.  So move the closedir() call lower.
> 
> Signed-off-by: Aaron Campbell <aaron@arbor.net>

Good catch!

Acked-by: Thomas Monjalon <thomas.monjalon@6wind.com>

Applied for version 1.7.0.

Thanks
-- 
Thomas