lib: Fix fqueue_next handling of deallocated flows

If a flow was deallocated while there were still unprocessed events in
an fqueue, it would cause a SEGV in fqueue_next because it was not
checking the validity of the returned flow descriptor.

Signed-off-by: Dimitri Staessens <[email protected]>
Signed-off-by: Sander Vrijders <[email protected]>

2 files changed, 8 insertions, 3 deletions

diff --git a/src/lib/dev.c b/src/lib/dev.c
index 7ffc2a0a..9b413bcd 100644
--- a/src/lib/dev.c
+++ b/src/lib/dev.c
@@ -167,7 +167,7 @@ static void port_destroy(struct port * p)
         while (p->state != PORT_NULL)
                 pthread_cond_wait(&p->state_cond, &p->state_lock);
 
-        p->fd = -1;
+        p->fd    = -1;
         p->state = PORT_INIT;
 
         pthread_mutex_unlock(&p->state_lock);
@@ -1624,6 +1624,12 @@ static int fqueue_filter(struct fqueue * fq)
                 pthread_rwlock_rdlock(&ai.lock);
 
                 fd = ai.ports[fq->fqueue[fq->next].flow_id].fd;
+                if (fd < 0) {
+                        ++fq->next;
+                        pthread_rwlock_unlock(&ai.lock);
+                        continue;
+                }
+
                 frcti = ai.flows[fd].frcti;
                 if (frcti == NULL) {
                         pthread_rwlock_unlock(&ai.lock);
@@ -1657,7 +1663,7 @@ static int fqueue_filter(struct fqueue * fq)
                 ++fq->next;
         }
 
-        return fq->next < fq->fqsize;
+        return 0;
 }
 
 int fqueue_next(struct fqueue * fq)
diff --git a/src/lib/shm_flow_set.c b/src/lib/shm_flow_set.c
index 25e7e32b..f8c6bb2c 100644
--- a/src/lib/shm_flow_set.c
+++ b/src/lib/shm_flow_set.c
@@ -314,7 +314,6 @@ void shm_flow_set_notify(struct shm_flow_set * set,
                 return;
         }
 
-
         e = fqueue_ptr(set, set->mtable[flow_id]) +
                 set->heads[set->mtable[flow_id]];