[dpdk-stable] patch 'net/vmxnet3: fix dereference before null check' has been queued to stable release 17.08.1

Yuanhan Liu yliu at fridaylinux.org
Tue Nov 21 14:16:51 CET 2017


Hi,

FYI, your patch has been queued to stable release 17.08.1

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 11/24/17. So please
shout if anyone has objections.

Thanks.

	--yliu

---
>From 0367d411ea10651d99c27d083df8c3149dfb266c Mon Sep 17 00:00:00 2001
From: Michal Jastrzebski <michalx.k.jastrzebski at intel.com>
Date: Fri, 29 Sep 2017 15:04:02 +0200
Subject: [PATCH] net/vmxnet3: fix dereference before null check

[ upstream commit 4d0833e6f8d4c9814b0c8fa1a2f8ed2263ae4856 ]

Coverity reports check_after_deref:
Null-checking rq suggests that it may be null, but it
has already been dereferenced on all paths leading to
the check.
This patch removes NULL checking of "rq" from function
vmxnet3_dev_rx_queue_reset as it is already checked against NULL
one level up the callstack (function vmxnet3_dev_clear_queues).

Coverity issue: 143468
Fixes: 5aecdc17a97d ("vmxnet3: fix stop/restart")

Signed-off-by: Tomasz Kulasek <tomaszx.kulasek at intel.com>
Signed-off-by: Michal Jastrzebski <michalx.k.jastrzebski at intel.com>
Reviewed-by: Ferruh Yigit <ferruh.yigit at intel.com>
---
 drivers/net/vmxnet3/vmxnet3_rxtx.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/drivers/net/vmxnet3/vmxnet3_rxtx.c b/drivers/net/vmxnet3/vmxnet3_rxtx.c
index 680da17..0c37de7 100644
--- a/drivers/net/vmxnet3/vmxnet3_rxtx.c
+++ b/drivers/net/vmxnet3/vmxnet3_rxtx.c
@@ -265,11 +265,9 @@ vmxnet3_dev_rx_queue_reset(void *rxq)
 	struct vmxnet3_rx_data_ring *data_ring = &rq->data_ring;
 	int size;
 
-	if (rq != NULL) {
-		/* Release both the cmd_rings mbufs */
-		for (i = 0; i < VMXNET3_RX_CMDRING_SIZE; i++)
-			vmxnet3_rx_cmd_ring_release_mbufs(&rq->cmd_ring[i]);
-	}
+	/* Release both the cmd_rings mbufs */
+	for (i = 0; i < VMXNET3_RX_CMDRING_SIZE; i++)
+		vmxnet3_rx_cmd_ring_release_mbufs(&rq->cmd_ring[i]);
 
 	ring0 = &rq->cmd_ring[0];
 	ring1 = &rq->cmd_ring[1];
-- 
2.7.4



More information about the stable mailing list