From patchwork Fri Sep 22 13:07:52 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michal Jastrzebski X-Patchwork-Id: 29109 Return-Path: X-Original-To: patchwork@dpdk.org Delivered-To: patchwork@dpdk.org Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id 15B051B18C; Fri, 22 Sep 2017 15:08:19 +0200 (CEST) Received: from mga01.intel.com (mga01.intel.com [192.55.52.88]) by dpdk.org (Postfix) with ESMTP id D424C7D4E; Fri, 22 Sep 2017 15:08:16 +0200 (CEST) Received: from fmsmga002.fm.intel.com ([10.253.24.26]) by fmsmga101.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 22 Sep 2017 06:07:58 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos; i="5.42,427,1500966000"; d="scan'208"; a="1222367834" Received: from unknown ([10.103.102.61]) by fmsmga002.fm.intel.com with SMTP; 22 Sep 2017 06:07:54 -0700 Received: by (sSMTP sendmail emulation); Fri, 22 Sep 2017 15:07:53 +0200 From: Michal Jastrzebski To: yliu@fridaylinux.org, maxime.coquelin@redhat.com Cc: dev@dpdk.org, deepak.k.jain@intel.com, Tomasz Kulasek , yongwang@vmware.com, stable@dpdk.org Date: Fri, 22 Sep 2017 15:07:52 +0200 Message-Id: <20170922130752.1908-1-michalx.k.jastrzebski@intel.com> X-Mailer: git-send-email 2.12.2 Subject: [dpdk-dev] [PATCH] net/vmxnet3: fix dereference before null check X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" From: Tomasz Kulasek Coverity error: check_after_deref: Null-checking rq suggests that it may be null, but it has already been dereferenced on all paths leading to the check. This patch moves NULL checking of "rq" at the very beginning of the path before any dereference. Coverity issue: 143468 Fixes: 5aecdc17a97d ("vmxnet3: fix stop/restart") Cc: yongwang@vmware.com Cc: stable@dpdk.org Signed-off-by: Tomasz Kulasek --- drivers/net/vmxnet3/vmxnet3_rxtx.c | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/drivers/net/vmxnet3/vmxnet3_rxtx.c b/drivers/net/vmxnet3/vmxnet3_rxtx.c index d9cf437..4fcceb4 100644 --- a/drivers/net/vmxnet3/vmxnet3_rxtx.c +++ b/drivers/net/vmxnet3/vmxnet3_rxtx.c @@ -259,17 +259,16 @@ { int i; vmxnet3_rx_queue_t *rq = rxq; - struct vmxnet3_hw *hw = rq->hw; struct vmxnet3_cmd_ring *ring0, *ring1; struct vmxnet3_comp_ring *comp_ring; - struct vmxnet3_rx_data_ring *data_ring = &rq->data_ring; int size; - if (rq != NULL) { - /* Release both the cmd_rings mbufs */ - for (i = 0; i < VMXNET3_RX_CMDRING_SIZE; i++) - vmxnet3_rx_cmd_ring_release_mbufs(&rq->cmd_ring[i]); - } + if (rq == NULL) + return; + + /* Release both the cmd_rings mbufs */ + for (i = 0; i < VMXNET3_RX_CMDRING_SIZE; i++) + vmxnet3_rx_cmd_ring_release_mbufs(&rq->cmd_ring[i]); ring0 = &rq->cmd_ring[0]; ring1 = &rq->cmd_ring[1]; @@ -287,8 +286,8 @@ size = sizeof(struct Vmxnet3_RxDesc) * (ring0->size + ring1->size); size += sizeof(struct Vmxnet3_RxCompDesc) * comp_ring->size; - if (VMXNET3_VERSION_GE_3(hw) && rq->data_desc_size) - size += rq->data_desc_size * data_ring->size; + if (VMXNET3_VERSION_GE_3(rq->hw) && rq->data_desc_size) + size += rq->data_desc_size * rq->data_ring.size; memset(ring0->base, 0, size); }