lib: Fix locking on flow read

Reading a deallocated flow could cause an assert on a negative id. The
raw-flow path now holds proc.lock across flow_rx_spb rather than
dropping it first, and the FRCT loop no longer releases and reacquires
the lock on every iteration.

Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks>
Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>

1 files changed, 13 insertions, 9 deletions

diff --git a/src/lib/dev.c b/src/lib/dev.c
index 0586f012..166aba5c 100644
--- a/src/lib/dev.c
+++ b/src/lib/dev.c
@@ -2656,23 +2656,24 @@ int ipcp_flow_read(int                   fd,
 
         pthread_rwlock_rdlock(&proc.lock);
 
-        assert(flow->info.id >= 0);
+        if (flow->info.id < 0) {
+                pthread_rwlock_unlock(&proc.lock);
+                return -ENOTALLOC;
+        }
 
         /* Raw flow: deliver the popped pkt directly (no FRCT rq). */
         if (flow->frcti == NULL) {
-                pthread_rwlock_unlock(&proc.lock);
                 idx = flow_rx_spb(flow, spb, false, NULL);
+                pthread_rwlock_unlock(&proc.lock);
                 return idx < 0 ? (int) idx : 0;
         }
 
         while (!FRCTI_PDU_READY(flow->frcti)) {
-                pthread_rwlock_unlock(&proc.lock);
-
                 idx = flow_rx_spb(flow, spb, false, NULL);
-                if (idx < 0)
+                if (idx < 0) {
+                        pthread_rwlock_unlock(&proc.lock);
                         return idx;
-
-                pthread_rwlock_rdlock(&proc.lock);
+                }
 
                 FRCTI_RCV(flow->frcti, *spb);
         }
@@ -2745,10 +2746,13 @@ int np1_flow_read(int                   fd,
 
         flow = &proc.flows[fd];
 
-        assert(flow->info.id >= 0);
-
         pthread_rwlock_rdlock(&proc.lock);
 
+        if (flow->info.id < 0) {
+                pthread_rwlock_unlock(&proc.lock);
+                return -ENOTALLOC;
+        }
+
         off = ssm_rbuff_read(flow->rx_rb);
         if (off < 0) {
                 pthread_rwlock_unlock(&proc.lock);