Merge pull request #1162 from tempesta-tech/ik-fix-uninited-var

fix #1147 : init frag variable before use.

Author: vankoven

tempesta_fw/http.c

@@ -438,7 +438,7 @@ tfw_http_prep_redirect(TfwHttpMsg *resp, unsigned short status, TfwStr *rmark,
 	tfw_http_prep_date(__TFW_STR_CH(&h_common_1, 1)->data);
 
 	ret = tfw_msg_write(&it, rh);
-	ret = tfw_msg_write(&it, &h_common_1);
+	ret |= tfw_msg_write(&it, &h_common_1);
 	/*
 	 * HTTP/1.0 may have no host part, so we create relative URI.
 	 * See RFC 1945 9.3 and RFC 7231 7.1.2.
@@ -2787,8 +2787,6 @@ tfw_http_hm_drop_resp(TfwHttpResp *resp)
 	TfwHttpReq *req = resp->req;
 
 	tfw_connection_unlink_msg(resp->conn);
-	tfw_apm_update(((TfwServer *)resp->conn->peer)->apmref,
-		       resp->jrxtstamp, resp->jrxtstamp - req->jtxtstamp);
 	tfw_http_conn_msg_free((TfwHttpMsg *)resp);
 	tfw_http_msg_free((TfwHttpMsg *)req);
 }

tempesta_fw/msg.c

@@ -34,20 +34,22 @@
 int
 tfw_msg_write(TfwMsgIter *it, const TfwStr *data)
 {
-	char *p;
 	const TfwStr *c, *end;
-	skb_frag_t *frag;
-	unsigned int c_off = 0, f_size, c_size, f_room, n_copy;
 
 	BUG_ON(TFW_STR_DUP(data));
+	if (WARN_ON_ONCE(it->frag >= skb_shinfo(it->skb)->nr_frags))
+		return -E2BIG;
+
 	TFW_STR_FOR_EACH_CHUNK(c, data, end) {
+		char *p;
+		unsigned int c_off = 0, c_size, f_room, n_copy;
 this_chunk:
-		if (!frag)
-			return -E2BIG;
 
 		c_size = c->len - c_off;
 		if (it->frag >= 0) {
-			frag = &skb_shinfo(it->skb)->frags[it->frag];
+			unsigned int f_size;
+			skb_frag_t *frag = &skb_shinfo(it->skb)->frags[it->frag];
+
 			f_size = skb_frag_size(frag);
 			f_room = PAGE_SIZE - frag->page_offset - f_size;
 			p = (char *)skb_frag_address(frag) + f_size;
@@ -62,24 +64,26 @@ tfw_msg_write(TfwMsgIter *it, const TfwStr *data)
 
 		memcpy_fast(p, c->data + c_off, n_copy);
 
-		if (c_size < f_room) {
-			/*
-			 * The chunk fits in the SKB fragment with room
-			 * to spare. Stay in the same SKB fragment, switch
-			 * to next chunk of the string.
-			 */
-			c_off = 0;
-		} else {
-			frag = ss_skb_frag_next(&it->skb, it->skb_head,
-						&it->frag);
+		/*
+		 * The chunk occupied all the spare space in the SKB fragment,
+		 * switch to the next fragment.
+		 */
+		if (c_size >= f_room) {
+			skb_frag_t *frag = ss_skb_frag_next(&it->skb,
+							    it->skb_head,
+							    &it->frag);
+			if (WARN_ON_ONCE(!frag
+					 && ((c_size != f_room)
+					     || (c + 1 < end))))
+			{
+				return -E2BIG;
+			}
 			/*
-			 * If all data from the chunk has been copied,
-			 * then switch to the next chunk. Otherwise,
-			 * stay in the current chunk.
+			 * Not all data from the chunk has been copied,
+			 * stay in the current chunk and copy the rest to the
+			 * next fragment.
 			 */
-			if (c_size == f_room) {
-				c_off = 0;
-			} else {
+			if (c_size != f_room) {
 				c_off += n_copy;
 				goto this_chunk;
 			}

tempesta_fw/ss_skb.h

@@ -129,9 +129,9 @@ ss_skb_frag_next(struct sk_buff **skb, const struct sk_buff *skb_head, int *f)
 	}
 
 	*skb = (*skb)->next;
+	*f = 0;
 	if (*skb == skb_head || !skb_shinfo(*skb)->nr_frags)
 		return NULL;
-	*f = 0;
 	return &skb_shinfo(*skb)->frags[0];
 }