compress/nitrox: fix dereference after null check
Checks
Commit Message
In nitrox_check_comp_req() while updating the last byte during FINAL
flush there is possibility of accessing null mbuf in two rare cases.
First case is when the application changes the dst mbuf between
enqueue and dequeue. Second case is when data length reported by
hardware is greater than the mbuf length. Fix this issue by adding
mbuf null checks.
Coverity issue: 415046
Fixes: f008628a6d08 ("compress/nitrox: support stateless request")
Signed-off-by: Nagadheeraj Rottela <rnagadheeraj@marvell.com>
---
drivers/compress/nitrox/nitrox_comp_reqmgr.c | 10 ++++++++++
1 file changed, 10 insertions(+)
Comments
> Subject: [PATCH] compress/nitrox: fix dereference after null check
>
> In nitrox_check_comp_req() while updating the last byte during FINAL
> flush there is possibility of accessing null mbuf in two rare cases.
> First case is when the application changes the dst mbuf between
> enqueue and dequeue. Second case is when data length reported by
> hardware is greater than the mbuf length. Fix this issue by adding
> mbuf null checks.
>
> Coverity issue: 415046
> Fixes: f008628a6d08 ("compress/nitrox: support stateless request")
> Signed-off-by: Nagadheeraj Rottela <rnagadheeraj@marvell.com>
Applied to dpdk-next-crypto
Thanks.
@@ -1096,10 +1096,20 @@ nitrox_check_comp_req(struct nitrox_softreq *sr, struct rte_comp_op **op)
for (; m && off > rte_pktmbuf_data_len(m); m = m->next)
off -= rte_pktmbuf_data_len(m);
+ if (unlikely(m == NULL)) {
+ err = -EINVAL;
+ goto exit;
+ }
+
mlen = rte_pktmbuf_data_len(m) - off;
for (; m && (datalen > mlen); m = m->next)
datalen -= mlen;
+ if (unlikely(m == NULL)) {
+ err = -EINVAL;
+ goto exit;
+ }
+
last_byte = rte_pktmbuf_mtod_offset(m, uint8_t *, datalen - 1);
*last_byte = zip_res.w2.exbits & 0xFF;
}