From patchwork Wed Mar 13 06:02:08 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nagadheeraj Rottela X-Patchwork-Id: 138305 X-Patchwork-Delegate: gakhil@marvell.com Return-Path: X-Original-To: patchwork@inbox.dpdk.org Delivered-To: patchwork@inbox.dpdk.org Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 983A543C9A; Wed, 13 Mar 2024 07:02:39 +0100 (CET) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 71E2240689; Wed, 13 Mar 2024 07:02:39 +0100 (CET) Received: from mx0b-0016f401.pphosted.com (mx0a-0016f401.pphosted.com [67.231.148.174]) by mails.dpdk.org (Postfix) with ESMTP id DF86140633 for ; Wed, 13 Mar 2024 07:02:37 +0100 (CET) Received: from pps.filterd (m0045849.ppops.net [127.0.0.1]) by mx0a-0016f401.pphosted.com (8.17.1.24/8.17.1.24) with ESMTP id 42D3bVwf014957; Tue, 12 Mar 2024 23:02:37 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=marvell.com; h= from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding:content-type; s=pfpt0220; bh=aDb8Egni oJCynq1XPjpsV+A+4Dx7LWFxgqoeSi0hQQM=; b=RXxCaoQh85XgE0DehAHoNLBd tr/a9Y0QMZkS34i3sznyzyASQmb/x3XalxyXYD2R4bV+kDeJTqvT9dffebLojfmm j9xuXNezTc9e4jx2VytrC/KdRDhHqFOIJjqOcrT6jzqCRjGp2+5uKiIdaVUjlh+4 VKPT7SwH46su9kh65ezkj8xFzgfUNLa2LcwpbiEtIZziiml4mRcOPXXVuFTpjClV WToZ7uyLFlxUvt7U8OUE6q7F8ITUix+fGVsbJKIeiIHLFGUPm9fNnGbhGREbhPeP hD0GLCrsbaGdBEAbNn2/P8+13o5M5VANnbZNIe1xQiNER9cUTyqNeiWfjYAGfg== Received: from dc6wp-exch02.marvell.com ([4.21.29.225]) by mx0a-0016f401.pphosted.com (PPS) with ESMTPS id 3wtt8htms3-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 12 Mar 2024 23:02:36 -0700 (PDT) Received: from DC6WP-EXCH02.marvell.com (10.76.176.209) by DC6WP-EXCH02.marvell.com (10.76.176.209) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1258.12; Tue, 12 Mar 2024 23:02:35 -0700 Received: from hyd1399.caveonetworks.com (10.69.176.80) by DC6WP-EXCH02.marvell.com (10.76.176.209) with Microsoft SMTP Server id 15.2.1258.12 via Frontend Transport; Tue, 12 Mar 2024 23:02:33 -0700 From: Nagadheeraj Rottela To: , , CC: , Nagadheeraj Rottela Subject: [PATCH] compress/nitrox: fix dereference after null check Date: Wed, 13 Mar 2024 11:32:08 +0530 Message-ID: <20240313060208.17791-1-rnagadheeraj@marvell.com> X-Mailer: git-send-email 2.42.0 MIME-Version: 1.0 X-Proofpoint-ORIG-GUID: a3gsjbBGACBUadfaPB7Awt_ZquEJ5hRB X-Proofpoint-GUID: a3gsjbBGACBUadfaPB7Awt_ZquEJ5hRB X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.272,Aquarius:18.0.1011,Hydra:6.0.619,FMLib:17.11.176.26 definitions=2024-03-13_05,2024-03-12_01,2023-05-22_02 X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org In nitrox_check_comp_req() while updating the last byte during FINAL flush there is possibility of accessing null mbuf in two rare cases. First case is when the application changes the dst mbuf between enqueue and dequeue. Second case is when data length reported by hardware is greater than the mbuf length. Fix this issue by adding mbuf null checks. Coverity issue: 415046 Fixes: f008628a6d08 ("compress/nitrox: support stateless request") Signed-off-by: Nagadheeraj Rottela --- drivers/compress/nitrox/nitrox_comp_reqmgr.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/compress/nitrox/nitrox_comp_reqmgr.c b/drivers/compress/nitrox/nitrox_comp_reqmgr.c index 0a25672d6e..ca45c3e322 100644 --- a/drivers/compress/nitrox/nitrox_comp_reqmgr.c +++ b/drivers/compress/nitrox/nitrox_comp_reqmgr.c @@ -1096,10 +1096,20 @@ nitrox_check_comp_req(struct nitrox_softreq *sr, struct rte_comp_op **op) for (; m && off > rte_pktmbuf_data_len(m); m = m->next) off -= rte_pktmbuf_data_len(m); + if (unlikely(m == NULL)) { + err = -EINVAL; + goto exit; + } + mlen = rte_pktmbuf_data_len(m) - off; for (; m && (datalen > mlen); m = m->next) datalen -= mlen; + if (unlikely(m == NULL)) { + err = -EINVAL; + goto exit; + } + last_byte = rte_pktmbuf_mtod_offset(m, uint8_t *, datalen - 1); *last_byte = zip_res.w2.exbits & 0xFF; }