diff mbox series

compress/nitrox: fix dereference after null check

Message ID 20240313060208.17791-1-rnagadheeraj@marvell.com (mailing list archive)
State Accepted, archived
Delegated to: akhil goyal
Headers
Series compress/nitrox: fix dereference after null check |

Checks

Context Check Description
ci/checkpatch success coding style OK
ci/loongarch-compilation success Compilation OK
ci/loongarch-unit-testing success Unit Testing PASS
ci/Intel-compilation success Compilation OK
ci/intel-Testing success Testing PASS
ci/github-robot: build fail github build: failed
ci/intel-Functional success Functional PASS
ci/iol-intel-Performance success Performance Testing PASS
ci/iol-intel-Functional success Functional Testing PASS
ci/iol-mellanox-Performance success Performance Testing PASS
ci/iol-abi-testing success Testing PASS
ci/iol-unit-amd64-testing success Testing PASS
ci/iol-sample-apps-testing success Testing PASS
ci/iol-compile-amd64-testing success Testing PASS
ci/iol-unit-arm64-testing success Testing PASS
ci/iol-compile-arm64-testing success Testing PASS
ci/iol-broadcom-Performance success Performance Testing PASS
ci/iol-broadcom-Functional success Functional Testing PASS

Commit Message

Nagadheeraj Rottela March 13, 2024, 6:02 a.m. UTC 
  In nitrox_check_comp_req() while updating the last byte during FINAL
flush there is possibility of accessing null mbuf in two rare cases.
First case is when the application changes the dst mbuf between
enqueue and dequeue. Second case is when data length reported by
hardware is greater than the mbuf length. Fix this issue by adding
mbuf null checks.

Coverity issue: 415046
Fixes: f008628a6d08 ("compress/nitrox: support stateless request")
Signed-off-by: Nagadheeraj Rottela <rnagadheeraj@marvell.com>
---
 drivers/compress/nitrox/nitrox_comp_reqmgr.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

Comments

Akhil Goyal March 13, 2024, 2:50 p.m. UTC | #1 
> Subject: [PATCH] compress/nitrox: fix dereference after null check
> 
> In nitrox_check_comp_req() while updating the last byte during FINAL
> flush there is possibility of accessing null mbuf in two rare cases.
> First case is when the application changes the dst mbuf between
> enqueue and dequeue. Second case is when data length reported by
> hardware is greater than the mbuf length. Fix this issue by adding
> mbuf null checks.
> 
> Coverity issue: 415046
> Fixes: f008628a6d08 ("compress/nitrox: support stateless request")
> Signed-off-by: Nagadheeraj Rottela <rnagadheeraj@marvell.com>
Applied to dpdk-next-crypto
Thanks.
diff mbox series

Patch

diff --git a/drivers/compress/nitrox/nitrox_comp_reqmgr.c b/drivers/compress/nitrox/nitrox_comp_reqmgr.c
index 0a25672d6e..ca45c3e322 100644
--- a/drivers/compress/nitrox/nitrox_comp_reqmgr.c
+++ b/drivers/compress/nitrox/nitrox_comp_reqmgr.c
@@ -1096,10 +1096,20 @@  nitrox_check_comp_req(struct nitrox_softreq *sr, struct rte_comp_op **op)
 		for (; m && off > rte_pktmbuf_data_len(m); m = m->next)
 			off -= rte_pktmbuf_data_len(m);
 
+		if (unlikely(m == NULL)) {
+			err = -EINVAL;
+			goto exit;
+		}
+
 		mlen = rte_pktmbuf_data_len(m) - off;
 		for (; m && (datalen > mlen); m = m->next)
 			datalen -= mlen;
 
+		if (unlikely(m == NULL)) {
+			err = -EINVAL;
+			goto exit;
+		}
+
 		last_byte = rte_pktmbuf_mtod_offset(m, uint8_t *, datalen - 1);
 		*last_byte = zip_res.w2.exbits & 0xFF;
 	}