[v2,2/2] raw/ifpga/base: check pointer adapter before dereference
Checks
Commit Message
In opae_adapter_destroy(), pointer "adapter" is not validated before
passing it to opae_adapter_shm_free() and opae_adapter_mutex_close()
which dereference it.
Fixes: e41856b515ce ("raw/ifpga/base: enhance driver reliability in multi-process")
Coverity issue: 363752
Signed-off-by: Wei Huang <wei.huang@intel.com>
---
v2: fix typo in commit log
---
drivers/raw/ifpga/base/opae_hw_api.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
Comments
Hi,
> -----Original Message-----
> From: Huang, Wei <wei.huang@intel.com>
> Sent: Thursday, November 05, 2020 10:06
> To: dev@dpdk.org; Xu, Rosen <rosen.xu@intel.com>; Zhang, Qi Z
> <qi.z.zhang@intel.com>
> Cc: stable@dpdk.org; Huang, Wei <wei.huang@intel.com>
> Subject: [PATCH v2 2/2] raw/ifpga/base: check pointer adapter before
> dereference
>
> In opae_adapter_destroy(), pointer "adapter" is not validated before passing
> it to opae_adapter_shm_free() and opae_adapter_mutex_close() which
> dereference it.
>
> Fixes: e41856b515ce ("raw/ifpga/base: enhance driver reliability in multi-
> process") Coverity issue: 363752
>
> Signed-off-by: Wei Huang <wei.huang@intel.com>
> ---
> v2: fix typo in commit log
> ---
> drivers/raw/ifpga/base/opae_hw_api.c | 10 ++++++----
> 1 file changed, 6 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/raw/ifpga/base/opae_hw_api.c
> b/drivers/raw/ifpga/base/opae_hw_api.c
> index 600afdea1..d5cd5fe60 100644
> --- a/drivers/raw/ifpga/base/opae_hw_api.c
> +++ b/drivers/raw/ifpga/base/opae_hw_api.c
> @@ -605,10 +605,12 @@ int opae_adapter_enumerate(struct opae_adapter
> *adapter)
> */
> void opae_adapter_destroy(struct opae_adapter *adapter) {
> - if (adapter && adapter->ops && adapter->ops->destroy)
> - adapter->ops->destroy(adapter);
> - opae_adapter_shm_free(adapter);
> - opae_adapter_mutex_close(adapter);
> + if (adapter) {
> + if (adapter->ops && adapter->ops->destroy)
> + adapter->ops->destroy(adapter);
> + opae_adapter_shm_free(adapter);
> + opae_adapter_mutex_close(adapter);
> + }
> }
>
> /**
> --
> 2.29.2
Acked-by: Rosen Xu <rosen.xu@intel.com>
@@ -605,10 +605,12 @@ int opae_adapter_enumerate(struct opae_adapter *adapter)
*/
void opae_adapter_destroy(struct opae_adapter *adapter)
{
- if (adapter && adapter->ops && adapter->ops->destroy)
- adapter->ops->destroy(adapter);
- opae_adapter_shm_free(adapter);
- opae_adapter_mutex_close(adapter);
+ if (adapter) {
+ if (adapter->ops && adapter->ops->destroy)
+ adapter->ops->destroy(adapter);
+ opae_adapter_shm_free(adapter);
+ opae_adapter_mutex_close(adapter);
+ }
}
/**