raw/ioat: fix dereference before null check
Checks
Commit Message
The 'idxd' pointer in 'idxd_rawdev_destroy()' is being dereferenced before
it is checked. To fix this, the null pointer check was moved to occur
earlier in the code.
Coverity issue: 363040
Fixes: ff06fa2cf3ba ("raw/ioat: probe idxd PCI")
Signed-off-by: Kevin Laatz <kevin.laatz@intel.com>
---
drivers/raw/ioat/idxd_pci.c | 16 +++++++++-------
1 file changed, 9 insertions(+), 7 deletions(-)
Comments
On Wed, Oct 14, 2020 at 11:11:10AM +0100, Kevin Laatz wrote:
> The 'idxd' pointer in 'idxd_rawdev_destroy()' is being dereferenced before
> it is checked. To fix this, the null pointer check was moved to occur
> earlier in the code.
>
> Coverity issue: 363040
> Fixes: ff06fa2cf3ba ("raw/ioat: probe idxd PCI")
>
> Signed-off-by: Kevin Laatz <kevin.laatz@intel.com>
> ---
Acked-by: Bruce Richardson <bruce.richardson@intel.com>
14/10/2020 13:34, Bruce Richardson:
> On Wed, Oct 14, 2020 at 11:11:10AM +0100, Kevin Laatz wrote:
> > The 'idxd' pointer in 'idxd_rawdev_destroy()' is being dereferenced before
> > it is checked. To fix this, the null pointer check was moved to occur
> > earlier in the code.
> >
> > Coverity issue: 363040
> > Fixes: ff06fa2cf3ba ("raw/ioat: probe idxd PCI")
> >
> > Signed-off-by: Kevin Laatz <kevin.laatz@intel.com>
> > ---
> Acked-by: Bruce Richardson <bruce.richardson@intel.com>
Applied, thanks
@@ -290,6 +290,10 @@ idxd_rawdev_destroy(const char *name)
}
idxd = rdev->dev_private;
+ if (!idxd) {
+ IOAT_PMD_ERR("Error getting dev_private");
+ return -EINVAL;
+ }
/* disable the device */
err_code = idxd_pci_dev_command(idxd, idxd_disable_dev);
@@ -300,13 +304,11 @@ idxd_rawdev_destroy(const char *name)
IOAT_PMD_DEBUG("IDXD Device disabled OK");
/* free device memory */
- if (rdev->dev_private != NULL) {
- IOAT_PMD_DEBUG("Freeing device driver memory");
- rdev->dev_private = NULL;
- rte_free(idxd->public.batch_ring);
- rte_free(idxd->public.hdl_ring);
- rte_memzone_free(idxd->mz);
- }
+ IOAT_PMD_DEBUG("Freeing device driver memory");
+ rdev->dev_private = NULL;
+ rte_free(idxd->public.batch_ring);
+ rte_free(idxd->public.hdl_ring);
+ rte_memzone_free(idxd->mz);
/* rte_rawdev_close is called by pmd_release */
ret = rte_rawdev_pmd_release(rdev);