MINOR: proto_quic: Wrong allocations for TX rings and RX bufs
As mentionned in the comment, the tx_qrings and rxbufs members of
receiver struct must be pointers to pointers!
Modify the functions responsible of their allocations consequently.
Note that this code could work because sizeof rxbuf and sizeof tx_qrings
are greater than the size of pointer!
diff --git a/include/haproxy/receiver-t.h b/include/haproxy/receiver-t.h
index 91a6ea2..83ac049 100644
--- a/include/haproxy/receiver-t.h
+++ b/include/haproxy/receiver-t.h
@@ -68,11 +68,11 @@
struct eb_root odcids; /* QUIC original destination connection IDs. */
struct eb_root cids; /* QUIC connection IDs. */
__decl_thread(HA_RWLOCK_T cids_lock); /* RW lock for connection IDs tree accesses */
- struct qring *tx_qrings; /* Array of rings (one by thread) */
- struct mt_list tx_qring_list; /* The same as ->qrings but arranged in a list */
+ struct qring **tx_qrings; /* Array of rings (one by thread) */
+ struct mt_list tx_qring_list; /* The same as ->tx_qrings but arranged in a list */
struct quic_dghdlr **dghdlrs; /* Datagram handlers (one by thread) */
- struct rxbuf *rxbufs; /* Array of buffers for RX (one by thread) */
+ struct rxbuf **rxbufs; /* Array of buffers for RX (one by thread) */
struct mt_list rxbuf_list; /* The same as ->rxbufs but arranged in a list */
#endif
/* warning: this struct is huge, keep it at the bottom */
diff --git a/src/proto_quic.c b/src/proto_quic.c
index f7f9f7d..99b8afd 100644
--- a/src/proto_quic.c
+++ b/src/proto_quic.c
@@ -543,18 +543,26 @@
MT_LIST_INIT(&l->rx.tx_qring_list);
for (i = 0; i < global.nbthread; i++) {
unsigned char *buf;
- struct qring *qr = &l->rx.tx_qrings[i];
+ struct qring *qr;
+
+ qr = calloc(1, sizeof *qr);
+ if (!qr)
+ goto err;
buf = pool_alloc(pool_head_quic_tx_ring);
- if (!buf)
+ if (!buf) {
+ free(qr);
goto err;
+ }
qr->cbuf = cbuf_new(buf, QUIC_TX_RING_BUFSZ);
if (!qr->cbuf) {
pool_free(pool_head_quic_tx_ring, buf);
+ free(qr);
goto err;
}
+ l->rx.tx_qrings[i] = qr;
MT_LIST_APPEND(&l->rx.tx_qring_list, &qr->mt_list);
}
@@ -564,6 +572,7 @@
while ((qr = MT_LIST_POP(&l->rx.tx_qring_list, typeof(qr), mt_list))) {
pool_free(pool_head_quic_tx_ring, qr->cbuf->buf);
cbuf_free(qr->cbuf);
+ free(qr);
}
free(l->rx.tx_qrings);
return 0;
@@ -584,11 +593,19 @@
MT_LIST_INIT(&l->rx.rxbuf_list);
for (i = 0; i < global.nbthread; i++) {
char *buf;
+ struct rxbuf *rxbuf;
+
+ rxbuf = calloc(1, sizeof *rxbuf);
+ if (!rxbuf)
+ goto err;
- rxbuf = &l->rx.rxbufs[i];
buf = pool_alloc(pool_head_quic_rxbuf);
- if (!buf)
+ if (!buf) {
+ free(rxbuf);
goto err;
+ }
+
+ l->rx.rxbufs[i] = rxbuf;
rxbuf->buf = b_make(buf, QUIC_RX_BUFSZ, 0, 0);
LIST_INIT(&rxbuf->dgrams);
@@ -598,8 +615,10 @@
return 1;
err:
- while ((rxbuf = MT_LIST_POP(&l->rx.rxbuf_list, typeof(rxbuf), mt_list)))
+ while ((rxbuf = MT_LIST_POP(&l->rx.rxbuf_list, typeof(rxbuf), mt_list))) {
pool_free(pool_head_quic_rxbuf, rxbuf->buf.area);
+ free(rxbuf);
+ }
free(l->rx.rxbufs);
return 0;
}