tools/xenpaging: fix bug of Segmentation fault

Segmentation fault occurs in two situations:
1. argc is less than 3
2. xenpaging_init() fault

Signed-off-by: Yu Zhiguo <yuzg@cn.fujitsu.com>

1 files changed, 24 insertions, 10 deletions

diff --git a/tools/xenpaging/xenpaging.c b/tools/xenpaging/xenpaging.c
index a207ca8ac9..e8d59b064f 100644
--- a/tools/xenpaging/xenpaging.c
+++ b/tools/xenpaging/xenpaging.c
@@ -212,6 +212,9 @@ int xenpaging_teardown(xenpaging_t *paging)
 {
     int rc;
 
+    if ( paging == NULL )
+        return 0;
+
     /* Tear down domain paging in Xen */
     rc = xc_mem_event_disable(paging->xc_handle, paging->mem_event.domain_id);
     if ( rc != 0 )
@@ -447,20 +450,29 @@ static int evict_victim(xenpaging_t *paging, domid_t domain_id,
 
 int main(int argc, char *argv[])
 {
-    domid_t domain_id = atoi(argv[1]);
-    int num_pages = atoi(argv[2]);
+    domid_t domain_id;
+    int num_pages;
     xenpaging_t *paging;
-    xenpaging_victim_t victims[num_pages];
+    xenpaging_victim_t *victims;
     mem_event_request_t req;
     mem_event_response_t rsp;
     int i;
-    int rc;
+    int rc = -1, rc1;
 
     int open_flags = O_CREAT | O_TRUNC | O_RDWR;
     mode_t open_mode = S_IRUSR | S_IRGRP | S_IROTH | S_IWUSR | S_IWGRP | S_IWOTH;
     char filename[80];
     int fd;
 
+    if ( argc != 3 ) {
+        fprintf(stderr, "Usage: %s <domain_id> <num_pages>\n", argv[0]);
+	return -1;
+    }
+    domain_id = atoi(argv[1]);
+    num_pages = atoi(argv[2]);
+
+    victims = calloc(num_pages, sizeof(xenpaging_victim_t));
+
     /* Open file */
     sprintf(filename, "page_cache_%d", domain_id);
     fd = open(filename, open_flags, open_mode);
@@ -586,15 +598,17 @@ int main(int argc, char *argv[])
     }
 
  out:
+    free(victims);
+
     /* Tear down domain paging */
-    rc = xenpaging_teardown(paging);
-    if ( rc != 0 )
-    {
+    rc1 = xenpaging_teardown(paging);
+    if ( rc1 != 0 )
         ERROR("Error tearing down paging");
-        exit(1);
-    }
 
-    return 0;
+    if ( rc == 0 )
+        rc = rc1;
+
+    return rc;
 }