compress/isal: fix use after free
authorStephen Hemminger <stephen@networkplumber.org>
Tue, 21 May 2019 14:47:13 +0000 (07:47 -0700)
committerAkhil Goyal <akhil.goyal@nxp.com>
Fri, 5 Jul 2019 12:52:25 +0000 (14:52 +0200)
The release function was using qp->stream after already
releasing it and the null pointer checking was missing.

Also since rte_free(NULL) is a no-op, remove unnecessary
checks for NULL.

Coverity issure: 340860
Fixes: dc49e6aa4879 ("compress/isal: add ISA-L compression functionality")
Cc: stable@dpdk.org
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
Acked-by: Lee Daly <lee.daly@intel.com>
Acked-by: Fiona Trahe <fiona.trahe@intel.com>
drivers/compress/isal/isal_compress_pmd_ops.c

index fe99959..77ac6fc 100644 (file)
@@ -171,18 +171,12 @@ isal_comp_pmd_qp_release(struct rte_compressdev *dev, uint16_t qp_id)
        if (qp == NULL)
                return -EINVAL;
 
-       if (qp->stream != NULL)
-               rte_free(qp->stream);
-
-       if (qp->stream->level_buf != NULL)
+       if (qp->stream)
                rte_free(qp->stream->level_buf);
 
-       if (qp->state != NULL)
-               rte_free(qp->state);
-
-       if (qp->processed_pkts != NULL)
-               rte_ring_free(qp->processed_pkts);
-
+       rte_free(qp->state);
+       rte_ring_free(qp->processed_pkts);
+       rte_free(qp->stream);
        rte_free(qp);
        dev->data->queue_pairs[qp_id] = NULL;