net/bnxt: fix null pointer dereferences
Checks
Commit Message
From: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
Coverity reports that pointer "cpr->cp_ring_struct" may be
dereferenced with null value. This patch fixes this.
Coverity issue: 372063
Fixes: 5ed30db87fa8 ("net/bnxt: fix missing barriers in completion handling")
Cc: stable@dpdk.org
Signed-off-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
Reviewed-by: Ajit Khaparde <ajit.khaparde@broadcom.com>
Reviewed-by: Lance Richardson <lance.richardson@broadcom.com>
---
drivers/net/bnxt/bnxt_irq.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
Comments
On Tue, Jul 20, 2021 at 9:01 AM Kalesh A P <
kalesh-anakkur.purayil@broadcom.com> wrote:
> From: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
>
> Coverity reports that pointer "cpr->cp_ring_struct" may be
> dereferenced with null value. This patch fixes this.
>
> Coverity issue: 372063
> Fixes: 5ed30db87fa8 ("net/bnxt: fix missing barriers in completion
> handling")
> Cc: stable@dpdk.org
>
> Signed-off-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
> Reviewed-by: Ajit Khaparde <ajit.khaparde@broadcom.com>
> Reviewed-by: Lance Richardson <lance.richardson@broadcom.com>
>
Patch applied to dpdk-next-net-brcm
> ---
> drivers/net/bnxt/bnxt_irq.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/bnxt/bnxt_irq.c b/drivers/net/bnxt/bnxt_irq.c
> index ebdac83..122a1f9 100644
> --- a/drivers/net/bnxt/bnxt_irq.c
> +++ b/drivers/net/bnxt/bnxt_irq.c
> @@ -33,7 +33,6 @@ void bnxt_int_handler(void *param)
> return;
>
> raw_cons = cpr->cp_raw_cons;
> - cp_ring_size = cpr->cp_ring_struct->ring_size;
> pthread_mutex_lock(&bp->def_cp_lock);
> while (1) {
> if (!cpr || !cpr->cp_ring_struct || !cpr->cp_db.doorbell) {
> @@ -46,6 +45,7 @@ void bnxt_int_handler(void *param)
> return;
> }
>
> + cp_ring_size = cpr->cp_ring_struct->ring_size;
> cons = RING_CMP(cpr->cp_ring_struct, raw_cons);
> cmp = &cpr->cp_desc_ring[cons];
>
> --
> 2.10.1
>
>
@@ -33,7 +33,6 @@ void bnxt_int_handler(void *param)
return;
raw_cons = cpr->cp_raw_cons;
- cp_ring_size = cpr->cp_ring_struct->ring_size;
pthread_mutex_lock(&bp->def_cp_lock);
while (1) {
if (!cpr || !cpr->cp_ring_struct || !cpr->cp_db.doorbell) {
@@ -46,6 +45,7 @@ void bnxt_int_handler(void *param)
return;
}
+ cp_ring_size = cpr->cp_ring_struct->ring_size;
cons = RING_CMP(cpr->cp_ring_struct, raw_cons);
cmp = &cpr->cp_desc_ring[cons];