net/mlx5: fix null derefrence in mlx5 txq start
Checks
Commit Message
Pointer 'txq_ctrl' was dereferenced and then compared to NULL.
Change the order to keep the logic consistent.
Fixes: f49f44839df3 ("net/mlx5: share Tx control code")
Cc: stable@dpdk.org
Signed-off-by: Weiguo Li <liweiguo@xencore.cn>
---
drivers/net/mlx5/mlx5_trigger.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
Comments
Hi, Weiguo
Do we have some compiler's or linter's warning about the "dereference" ?
Actually it is not an issue, once we get txq_data pointer - the NULL is just added
with some offset, and there is pre-check before using the pointer.
And, please fix the typo in title - "derefErence".
With best regards,
Slava
> -----Original Message-----
> From: Weiguo Li <liwg06@foxmail.com>
> Sent: Saturday, November 4, 2023 6:06 AM
> To: Michael Baum <michaelba@nvidia.com>
> Cc: Matan Azrad <matan@nvidia.com>; dev@dpdk.org; stable@dpdk.org;
> Weiguo Li <liweiguo@xencore.cn>
> Subject: [PATCH] net/mlx5: fix null derefrence in mlx5 txq start
>
> Pointer 'txq_ctrl' was dereferenced and then compared to NULL.
> Change the order to keep the logic consistent.
>
> Fixes: f49f44839df3 ("net/mlx5: share Tx control code")
> Cc: stable@dpdk.org
>
> Signed-off-by: Weiguo Li <liweiguo@xencore.cn>
> ---
> drivers/net/mlx5/mlx5_trigger.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/net/mlx5/mlx5_trigger.c
> b/drivers/net/mlx5/mlx5_trigger.c index 7bdb897612..0741bf627d 100644
> --- a/drivers/net/mlx5/mlx5_trigger.c
> +++ b/drivers/net/mlx5/mlx5_trigger.c
> @@ -54,11 +54,14 @@ mlx5_txq_start(struct rte_eth_dev *dev)
>
> for (i = 0; i != priv->txqs_n; ++i) {
> struct mlx5_txq_ctrl *txq_ctrl = mlx5_txq_get(dev, i);
> - struct mlx5_txq_data *txq_data = &txq_ctrl->txq;
> + struct mlx5_txq_data *txq_data;
> uint32_t flags = MLX5_MEM_RTE | MLX5_MEM_ZERO;
>
> if (!txq_ctrl)
> continue;
> +
> + txq_data = &txq_ctrl->txq;
> +
> if (!txq_ctrl->is_hairpin)
> txq_alloc_elts(txq_ctrl);
> MLX5_ASSERT(!txq_ctrl->obj);
> --
> 2.34.1
@@ -54,11 +54,14 @@ mlx5_txq_start(struct rte_eth_dev *dev)
for (i = 0; i != priv->txqs_n; ++i) {
struct mlx5_txq_ctrl *txq_ctrl = mlx5_txq_get(dev, i);
- struct mlx5_txq_data *txq_data = &txq_ctrl->txq;
+ struct mlx5_txq_data *txq_data;
uint32_t flags = MLX5_MEM_RTE | MLX5_MEM_ZERO;
if (!txq_ctrl)
continue;
+
+ txq_data = &txq_ctrl->txq;
+
if (!txq_ctrl->is_hairpin)
txq_alloc_elts(txq_ctrl);
MLX5_ASSERT(!txq_ctrl->obj);