[dpdk-dev] [PATCH] examples/ioat: fix possible null dereference

[dpdk-dev] [PATCH] examples/ioat: fix possible null dereference

[Bruce Richardson]

When searching for raw devices with the correct type, we check the driver
name using strcmp, without first checking that the call to info get
succeeded and assigned a value to that pointer.

If the call to get the device info fails, we can treat it as if the device
didn't match, and continue the loop, so the easiest fix is just to skip the
strcmp if the driver_name is null. [A non-null value from a previous failed
match is ok as it too causes the same behaviour of another loop iteration].

Coverity issue: 350353
Fixes: 2328542ed84e ("examples/ioat: add rawdev copy mode")

Signed-off-by: Bruce Richardson <bruce.richardson@intel.com>
---
 examples/ioat/ioatfwd.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/examples/ioat/ioatfwd.c b/examples/ioat/ioatfwd.c
index a0cc5c496..e9117718f 100644
--- a/examples/ioat/ioatfwd.c
+++ b/examples/ioat/ioatfwd.c
@@ -751,8 +751,9 @@ assign_rawdevs(void)
 				if (rdev_id == rte_rawdev_count())
 					goto end;
 				rte_rawdev_info_get(rdev_id++, &rdev_info);
-			} while (strcmp(rdev_info.driver_name,
-				IOAT_PMD_RAWDEV_NAME_STR) != 0);
+			} while (rdev_info.driver_name == NULL ||
+					strcmp(rdev_info.driver_name,
+						IOAT_PMD_RAWDEV_NAME_STR) != 0);
 
 			cfg.ports[i].ioat_ids[j] = rdev_id - 1;
 			configure_rawdev_queue(cfg.ports[i].ioat_ids[j]);
-- 
2.21.0

Re: [dpdk-dev] [PATCH] examples/ioat: fix possible null dereference

[David Marchand]

On Mon, Nov 25, 2019 at 5:48 PM Bruce Richardson
<bruce.richardson@intel.com> wrote:
>
> When searching for raw devices with the correct type, we check the driver
> name using strcmp, without first checking that the call to info get
> succeeded and assigned a value to that pointer.
>
> If the call to get the device info fails, we can treat it as if the device
> didn't match, and continue the loop, so the easiest fix is just to skip the
> strcmp if the driver_name is null. [A non-null value from a previous failed
> match is ok as it too causes the same behaviour of another loop iteration].
>
> Coverity issue: 350353
> Fixes: 2328542ed84e ("examples/ioat: add rawdev copy mode")
>
> Signed-off-by: Bruce Richardson <bruce.richardson@intel.com>

Applied, thanks.



--
David Marchand