examples/ioat: handle failure case for ioat dequeue
Checks
Commit Message
On a failure with the ioat dequeue, -1 is returned, which was not properly
handled. This could lead to out-of-bounds reads on a later loop which
assumed a positive return value. Fix this by treating an error as though a
dequeue of 0 had been encountered.
Coverity issue: 350342
Fixes: 2328542ed84e ("examples/ioat: add rawdev copy mode")
Signed-off-by: Bruce Richardson <bruce.richardson@intel.com>
---
examples/ioat/ioatfwd.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
Comments
On Mon, Nov 25, 2019 at 03:23:03PM +0000, Bruce Richardson wrote:
> On a failure with the ioat dequeue, -1 is returned, which was not properly
> handled. This could lead to out-of-bounds reads on a later loop which
> assumed a positive return value. Fix this by treating an error as though a
> dequeue of 0 had been encountered.
>
> Coverity issue: 350342
FYI: also should fix issue: 350349
> Fixes: 2328542ed84e ("examples/ioat: add rawdev copy mode")
>
> Signed-off-by: Bruce Richardson <bruce.richardson@intel.com>
> ---
> examples/ioat/ioatfwd.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/examples/ioat/ioatfwd.c b/examples/ioat/ioatfwd.c
> index 5e623a4d5..9fc033bc3 100644
> --- a/examples/ioat/ioatfwd.c
> +++ b/examples/ioat/ioatfwd.c
> @@ -457,7 +457,7 @@ ioat_tx_port(struct rxtx_port_config *tx_config)
> MAX_PKT_BURST, NULL);
> }
>
> - if (nb_dq == 0)
> + if (nb_dq <= 0)
> return;
>
> if (copy_mode == COPY_MODE_IOAT_NUM)
> --
> 2.21.0
>
On Mon, Nov 25, 2019 at 5:23 PM Bruce Richardson
<bruce.richardson@intel.com> wrote:
>
> On Mon, Nov 25, 2019 at 03:23:03PM +0000, Bruce Richardson wrote:
> > On a failure with the ioat dequeue, -1 is returned, which was not properly
> > handled. This could lead to out-of-bounds reads on a later loop which
> > assumed a positive return value. Fix this by treating an error as though a
> > dequeue of 0 had been encountered.
> >
> > Coverity issue: 350342
> FYI: also should fix issue: 350349
>
> > Fixes: 2328542ed84e ("examples/ioat: add rawdev copy mode")
> >
> > Signed-off-by: Bruce Richardson <bruce.richardson@intel.com>
Applied, thanks.
--
David Marchand
@@ -457,7 +457,7 @@ ioat_tx_port(struct rxtx_port_config *tx_config)
MAX_PKT_BURST, NULL);
}
- if (nb_dq == 0)
+ if (nb_dq <= 0)
return;
if (copy_mode == COPY_MODE_IOAT_NUM)