commit 8d879e1a6bac47240a232893e914815f781fd4bf
author Benoît Ganne <bganne@cisco.com> Thu Jun 27 17:31:28 2019 +0200
committer Neale Ranns <nranns@cisco.com> Fri Jun 28 11:58:12 2019 +0000
tree 3bcbeabe6a3438b03ec631de75efdbdaf8c257b3
parent 4752b29cfe229806c1cb2ae852c188d36be4c7cf

tap: fix memory errors in create/delete

If the host interface name is not specified at creation, host_if_name
was wrongly set to a stack-allocated variable. Make sure it always
points to a heap allocated vector.
At deletion time, we must free all allocated vectors.

Type:fix

Change-Id: I17751f38e95097998d51225fdccbf3ce3c365593
Signed-off-by: Benoît Ganne <bganne@cisco.com>

src/vnet/devices/tap/tap.c

diff --git a/src/vnet/devices/tap/tap.c b/src/vnet/devices/tap/tap.c
index 8dc798a..38ac0f9 100644
--- a/src/vnet/devices/tap/tap.c
+++ b/src/vnet/devices/tap/tap.c
@@ -208,7 +208,7 @@
   vif->ifindex = if_nametoindex (ifr.ifr_ifrn.ifrn_name);
 
   if (!args->host_if_name)
-    args->host_if_name = (u8 *) ifr.ifr_ifrn.ifrn_name;
+    args->host_if_name = format (0, "%s", ifr.ifr_ifrn.ifrn_name);
 
   unsigned int offload = 0;
   hdrsz = sizeof (struct virtio_net_hdr_v1);
@@ -546,6 +546,10 @@
   vec_free (vif->rxq_vrings);
   vec_free (vif->txq_vrings);
 
+  vec_free (vif->host_if_name);
+  vec_free (vif->net_ns);
+  vec_free (vif->host_bridge);
+
   tm->tap_ids = clib_bitmap_set (tm->tap_ids, vif->id, 0);
   clib_memset (vif, 0, sizeof (*vif));
   pool_put (mm->interfaces, vif);