From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from dpdk.org (dpdk.org [92.243.14.124]) by dpdk.space (Postfix) with ESMTP id 217FBA05D3 for ; Thu, 23 May 2019 06:37:37 +0200 (CEST) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id 2BBC35689; Thu, 23 May 2019 06:37:35 +0200 (CEST) Received: from mga05.intel.com (mga05.intel.com [192.55.52.43]) by dpdk.org (Postfix) with ESMTP id 2ECC6A69; Thu, 23 May 2019 06:37:32 +0200 (CEST) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga001.jf.intel.com ([10.7.209.18]) by fmsmga105.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 22 May 2019 21:37:31 -0700 X-ExtLoop1: 1 Received: from dipei-st-npg.sh.intel.com ([10.67.110.220]) by orsmga001.jf.intel.com with ESMTP; 22 May 2019 21:37:30 -0700 From: Andy Pei To: dev@dpdk.org Cc: andy.pei@intel.com, rosen.xu@intel.com, stable@dpdk.org Date: Thu, 23 May 2019 12:31:22 +0800 Message-Id: <1558585882-222368-1-git-send-email-andy.pei@intel.com> X-Mailer: git-send-email 1.8.3.1 Subject: [dpdk-dev] [PATCH] net/ipn3ke: fix null pointer dereference X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" In current code, scenario may happens that when function ipn3ke_hw_tm_node_wr is called, struct ipn3ke_tm_node n has a NULL element parent_node, however, the element parent_node of struct ipn3ke_tm_node n is used in an invalid way. After applying this patch, this null pointer dereference is avoided. Coverity issue: 337921 Fixes: c820468ac99c ("net/ipn3ke: support TM") Cc: rosen.xu@intel.com Cc: stable@dpdk.org Signed-off-by: Andy Pei --- drivers/net/ipn3ke/ipn3ke_tm.c | 43 +++++++++++++++++++++++------------------- 1 file changed, 24 insertions(+), 19 deletions(-) diff --git a/drivers/net/ipn3ke/ipn3ke_tm.c b/drivers/net/ipn3ke/ipn3ke_tm.c index 4bcf3aa..30a3dfd 100644 --- a/drivers/net/ipn3ke/ipn3ke_tm.c +++ b/drivers/net/ipn3ke/ipn3ke_tm.c @@ -1579,7 +1579,8 @@ struct ipn3ke_tm_shaper_params_range_type ipn3ke_tm_shaper_params_rang[] = { static int ipn3ke_hw_tm_node_wr(struct ipn3ke_hw *hw, - struct ipn3ke_tm_node *n) + struct ipn3ke_tm_node *n, + struct ipn3ke_tm_node *parent_node) { uint32_t level; @@ -1650,11 +1651,12 @@ struct ipn3ke_tm_shaper_params_range_type ipn3ke_tm_shaper_params_rang[] = { /** * Configure Map */ - IPN3KE_MASK_WRITE_REG(hw, - IPN3KE_QOS_MAP_L2_X, - n->node_index, - n->parent_node->node_index, - IPN3KE_QOS_MAP_L2_MASK); + if (parent_node) + IPN3KE_MASK_WRITE_REG(hw, + IPN3KE_QOS_MAP_L2_X, + n->node_index, + parent_node->node_index, + IPN3KE_QOS_MAP_L2_MASK); break; case IPN3KE_TM_NODE_LEVEL_COS: @@ -1707,11 +1709,12 @@ struct ipn3ke_tm_shaper_params_range_type ipn3ke_tm_shaper_params_rang[] = { 0x80000000)) ; - IPN3KE_MASK_WRITE_REG(hw, - IPN3KE_QM_UID_CONFIG_DATA, - 0, - (1 << 8 | n->parent_node->parent_node->node_index), - 0x1FF); + if (parent_node && parent_node->parent_node) + IPN3KE_MASK_WRITE_REG(hw, + IPN3KE_QM_UID_CONFIG_DATA, + 0, + (1 << 8 | parent_node->parent_node->node_index), + 0x1FF); IPN3KE_MASK_WRITE_REG(hw, IPN3KE_QM_UID_CONFIG_CTRL, @@ -1728,11 +1731,12 @@ struct ipn3ke_tm_shaper_params_range_type ipn3ke_tm_shaper_params_rang[] = { /** * Configure Map */ - IPN3KE_MASK_WRITE_REG(hw, - IPN3KE_QOS_MAP_L1_X, - n->node_index, - n->parent_node->node_index, - IPN3KE_QOS_MAP_L1_MASK); + if (parent_node) + IPN3KE_MASK_WRITE_REG(hw, + IPN3KE_QOS_MAP_L1_X, + n->node_index, + parent_node->node_index, + IPN3KE_QOS_MAP_L1_MASK); break; default: @@ -1772,7 +1776,8 @@ struct ipn3ke_tm_shaper_params_range_type ipn3ke_tm_shaper_params_rang[] = { NULL, rte_strerror(EINVAL)); } - ipn3ke_hw_tm_node_wr(hw, n); + parent_node = n->parent_node; + ipn3ke_hw_tm_node_wr(hw, n, parent_node); } nl = &tm->h.vt_commit_node_list; @@ -1802,7 +1807,7 @@ struct ipn3ke_tm_shaper_params_range_type ipn3ke_tm_shaper_params_rang[] = { NULL, rte_strerror(EINVAL)); } - ipn3ke_hw_tm_node_wr(hw, n); + ipn3ke_hw_tm_node_wr(hw, n, parent_node); } nl = &tm->h.cos_commit_node_list; @@ -1836,7 +1841,7 @@ struct ipn3ke_tm_shaper_params_range_type ipn3ke_tm_shaper_params_rang[] = { NULL, rte_strerror(EINVAL)); } - ipn3ke_hw_tm_node_wr(hw, n); + ipn3ke_hw_tm_node_wr(hw, n, parent_node); } return 0; -- 1.8.3.1