* [dpdk-dev] [PATCH] net/vmxnet3: fix dereference before null check
@ 2017-09-22 13:07 Michal Jastrzebski
2017-09-22 13:19 ` Jastrzebski, MichalX K
0 siblings, 1 reply; 3+ messages in thread
From: Michal Jastrzebski @ 2017-09-22 13:07 UTC (permalink / raw)
To: yliu, maxime.coquelin
Cc: dev, deepak.k.jain, Tomasz Kulasek, yongwang, stable
From: Tomasz Kulasek <tomaszx.kulasek@intel.com>
Coverity error:
check_after_deref: Null-checking rq suggests that it may be null, but it
has already been dereferenced on all paths leading to
the check.
This patch moves NULL checking of "rq" at the very beginning of the path
before any dereference.
Coverity issue: 143468
Fixes: 5aecdc17a97d ("vmxnet3: fix stop/restart")
Cc: yongwang@vmware.com
Cc: stable@dpdk.org
Signed-off-by: Tomasz Kulasek <tomaszx.kulasek@intel.com>
---
drivers/net/vmxnet3/vmxnet3_rxtx.c | 17 ++++++++---------
1 file changed, 8 insertions(+), 9 deletions(-)
diff --git a/drivers/net/vmxnet3/vmxnet3_rxtx.c b/drivers/net/vmxnet3/vmxnet3_rxtx.c
index d9cf437..4fcceb4 100644
--- a/drivers/net/vmxnet3/vmxnet3_rxtx.c
+++ b/drivers/net/vmxnet3/vmxnet3_rxtx.c
@@ -259,17 +259,16 @@
{
int i;
vmxnet3_rx_queue_t *rq = rxq;
- struct vmxnet3_hw *hw = rq->hw;
struct vmxnet3_cmd_ring *ring0, *ring1;
struct vmxnet3_comp_ring *comp_ring;
- struct vmxnet3_rx_data_ring *data_ring = &rq->data_ring;
int size;
- if (rq != NULL) {
- /* Release both the cmd_rings mbufs */
- for (i = 0; i < VMXNET3_RX_CMDRING_SIZE; i++)
- vmxnet3_rx_cmd_ring_release_mbufs(&rq->cmd_ring[i]);
- }
+ if (rq == NULL)
+ return;
+
+ /* Release both the cmd_rings mbufs */
+ for (i = 0; i < VMXNET3_RX_CMDRING_SIZE; i++)
+ vmxnet3_rx_cmd_ring_release_mbufs(&rq->cmd_ring[i]);
ring0 = &rq->cmd_ring[0];
ring1 = &rq->cmd_ring[1];
@@ -287,8 +286,8 @@
size = sizeof(struct Vmxnet3_RxDesc) * (ring0->size + ring1->size);
size += sizeof(struct Vmxnet3_RxCompDesc) * comp_ring->size;
- if (VMXNET3_VERSION_GE_3(hw) && rq->data_desc_size)
- size += rq->data_desc_size * data_ring->size;
+ if (VMXNET3_VERSION_GE_3(rq->hw) && rq->data_desc_size)
+ size += rq->data_desc_size * rq->data_ring.size;
memset(ring0->base, 0, size);
}
--
1.9.1
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [dpdk-dev] [PATCH] net/vmxnet3: fix dereference before null check
2017-09-22 13:07 [dpdk-dev] [PATCH] net/vmxnet3: fix dereference before null check Michal Jastrzebski
@ 2017-09-22 13:19 ` Jastrzebski, MichalX K
0 siblings, 0 replies; 3+ messages in thread
From: Jastrzebski, MichalX K @ 2017-09-22 13:19 UTC (permalink / raw)
To: Jastrzebski, MichalX K, yliu, maxime.coquelin
Cc: dev, Jain, Deepak K, Kulasek, TomaszX, yongwang, stable
> -----Original Message-----
> From: dev [mailto:dev-bounces@dpdk.org] On Behalf Of Michal Jastrzebski
> Sent: Friday, September 22, 2017 3:08 PM
> To: yliu@fridaylinux.org; maxime.coquelin@redhat.com
> Cc: dev@dpdk.org; Jain, Deepak K <deepak.k.jain@intel.com>; Kulasek,
> TomaszX <tomaszx.kulasek@intel.com>; yongwang@vmware.com;
> stable@dpdk.org
> Subject: [dpdk-dev] [PATCH] net/vmxnet3: fix dereference before null check
>
> From: Tomasz Kulasek <tomaszx.kulasek@intel.com>
>
> Coverity error:
>
> check_after_deref: Null-checking rq suggests that it may be null, but it
> has already been dereferenced on all paths leading to
> the check.
>
> This patch moves NULL checking of "rq" at the very beginning of the path
> before any dereference.
>
> Coverity issue: 143468
> Fixes: 5aecdc17a97d ("vmxnet3: fix stop/restart")
> Cc: yongwang@vmware.com
> Cc: stable@dpdk.org
>
> Signed-off-by: Tomasz Kulasek <tomaszx.kulasek@intel.com>
> ---
> drivers/net/vmxnet3/vmxnet3_rxtx.c | 17 ++++++++---------
> 1 file changed, 8 insertions(+), 9 deletions(-)
>
> diff --git a/drivers/net/vmxnet3/vmxnet3_rxtx.c
> b/drivers/net/vmxnet3/vmxnet3_rxtx.c
> index d9cf437..4fcceb4 100644
> --- a/drivers/net/vmxnet3/vmxnet3_rxtx.c
> +++ b/drivers/net/vmxnet3/vmxnet3_rxtx.c
> @@ -259,17 +259,16 @@
> {
> int i;
> vmxnet3_rx_queue_t *rq = rxq;
> - struct vmxnet3_hw *hw = rq->hw;
> struct vmxnet3_cmd_ring *ring0, *ring1;
> struct vmxnet3_comp_ring *comp_ring;
> - struct vmxnet3_rx_data_ring *data_ring = &rq->data_ring;
> int size;
>
> - if (rq != NULL) {
> - /* Release both the cmd_rings mbufs */
> - for (i = 0; i < VMXNET3_RX_CMDRING_SIZE; i++)
> - vmxnet3_rx_cmd_ring_release_mbufs(&rq-
> >cmd_ring[i]);
> - }
> + if (rq == NULL)
> + return;
> +
> + /* Release both the cmd_rings mbufs */
> + for (i = 0; i < VMXNET3_RX_CMDRING_SIZE; i++)
> + vmxnet3_rx_cmd_ring_release_mbufs(&rq->cmd_ring[i]);
>
> ring0 = &rq->cmd_ring[0];
> ring1 = &rq->cmd_ring[1];
> @@ -287,8 +286,8 @@
>
> size = sizeof(struct Vmxnet3_RxDesc) * (ring0->size + ring1->size);
> size += sizeof(struct Vmxnet3_RxCompDesc) * comp_ring->size;
> - if (VMXNET3_VERSION_GE_3(hw) && rq->data_desc_size)
> - size += rq->data_desc_size * data_ring->size;
> + if (VMXNET3_VERSION_GE_3(rq->hw) && rq->data_desc_size)
> + size += rq->data_desc_size * rq->data_ring.size;
>
> memset(ring0->base, 0, size);
> }
> --
> 1.9.1
I am sorry, please ignore this mail.
^ permalink raw reply [flat|nested] 3+ messages in thread
* [dpdk-dev] [PATCH] net/vmxnet3: fix dereference before null check
@ 2017-09-22 12:39 Michal Jastrzebski
0 siblings, 0 replies; 3+ messages in thread
From: Michal Jastrzebski @ 2017-09-22 12:39 UTC (permalink / raw)
To: skhare; +Cc: dev, deepak.k.jain, Tomasz Kulasek, yongwang, stable
From: Tomasz Kulasek <tomaszx.kulasek@intel.com>
Coverity error:
check_after_deref: Null-checking rq suggests that it may be null, but it
has already been dereferenced on all paths leading to
the check.
This patch moves NULL checking of "rq" at the very beginning of the path
before any dereference.
Coverity issue: 143468
Fixes: 5aecdc17a97d ("vmxnet3: fix stop/restart")
Cc: yongwang@vmware.com
Cc: stable@dpdk.org
Signed-off-by: Tomasz Kulasek <tomaszx.kulasek@intel.com>
---
drivers/net/vmxnet3/vmxnet3_rxtx.c | 17 ++++++++---------
1 file changed, 8 insertions(+), 9 deletions(-)
diff --git a/drivers/net/vmxnet3/vmxnet3_rxtx.c b/drivers/net/vmxnet3/vmxnet3_rxtx.c
index d9cf437..4fcceb4 100644
--- a/drivers/net/vmxnet3/vmxnet3_rxtx.c
+++ b/drivers/net/vmxnet3/vmxnet3_rxtx.c
@@ -259,17 +259,16 @@
{
int i;
vmxnet3_rx_queue_t *rq = rxq;
- struct vmxnet3_hw *hw = rq->hw;
struct vmxnet3_cmd_ring *ring0, *ring1;
struct vmxnet3_comp_ring *comp_ring;
- struct vmxnet3_rx_data_ring *data_ring = &rq->data_ring;
int size;
- if (rq != NULL) {
- /* Release both the cmd_rings mbufs */
- for (i = 0; i < VMXNET3_RX_CMDRING_SIZE; i++)
- vmxnet3_rx_cmd_ring_release_mbufs(&rq->cmd_ring[i]);
- }
+ if (rq == NULL)
+ return;
+
+ /* Release both the cmd_rings mbufs */
+ for (i = 0; i < VMXNET3_RX_CMDRING_SIZE; i++)
+ vmxnet3_rx_cmd_ring_release_mbufs(&rq->cmd_ring[i]);
ring0 = &rq->cmd_ring[0];
ring1 = &rq->cmd_ring[1];
@@ -287,8 +286,8 @@
size = sizeof(struct Vmxnet3_RxDesc) * (ring0->size + ring1->size);
size += sizeof(struct Vmxnet3_RxCompDesc) * comp_ring->size;
- if (VMXNET3_VERSION_GE_3(hw) && rq->data_desc_size)
- size += rq->data_desc_size * data_ring->size;
+ if (VMXNET3_VERSION_GE_3(rq->hw) && rq->data_desc_size)
+ size += rq->data_desc_size * rq->data_ring.size;
memset(ring0->base, 0, size);
}
--
1.9.1
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-09-22 13:22 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-09-22 13:07 [dpdk-dev] [PATCH] net/vmxnet3: fix dereference before null check Michal Jastrzebski
2017-09-22 13:19 ` Jastrzebski, MichalX K
-- strict thread matches above, loose matches on Subject: below --
2017-09-22 12:39 Michal Jastrzebski
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).