In nitrox_check_comp_req() while updating the last byte during FINAL
flush there is possibility of accessing null mbuf in two rare cases.
First case is when the application changes the dst mbuf between
enqueue and dequeue. Second case is when data length reported by
hardware is greater than the mbuf length. Fix this issue by adding
mbuf null checks.
Coverity issue: 415046
Fixes: f008628a6d08 ("compress/nitrox: support stateless request")
Signed-off-by: Nagadheeraj Rottela <rnagadhee...@marvell.com>
---
drivers/compress/nitrox/nitrox_comp_reqmgr.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/compress/nitrox/nitrox_comp_reqmgr.c
b/drivers/compress/nitrox/nitrox_comp_reqmgr.c
index 0a25672d6e..ca45c3e322 100644
--- a/drivers/compress/nitrox/nitrox_comp_reqmgr.c
+++ b/drivers/compress/nitrox/nitrox_comp_reqmgr.c
@@ -1096,10 +1096,20 @@ nitrox_check_comp_req(struct nitrox_softreq *sr, struct
rte_comp_op **op)
for (; m && off > rte_pktmbuf_data_len(m); m = m->next)
off -= rte_pktmbuf_data_len(m);
+ if (unlikely(m == NULL)) {
+ err = -EINVAL;
+ goto exit;
+ }
+
mlen = rte_pktmbuf_data_len(m) - off;
for (; m && (datalen > mlen); m = m->next)
datalen -= mlen;
+ if (unlikely(m == NULL)) {
+ err = -EINVAL;
+ goto exit;
+ }
+
last_byte = rte_pktmbuf_mtod_offset(m, uint8_t *, datalen - 1);
*last_byte = zip_res.w2.exbits & 0xFF;
}
--
2.42.0
