From abdb798ae22ee4374e9152580f22ff5fb42193a0 Mon Sep 17 00:00:00 2001 From: Stephen Hemminger Date: Tue, 21 May 2019 07:47:13 -0700 Subject: [PATCH] compress/isal: fix use after free The release function was using qp->stream after already releasing it and the null pointer checking was missing. Also since rte_free(NULL) is a no-op, remove unnecessary checks for NULL. Coverity issure: 340860 Fixes: dc49e6aa4879 ("compress/isal: add ISA-L compression functionality") Cc: stable@dpdk.org Signed-off-by: Stephen Hemminger Acked-by: Lee Daly Acked-by: Fiona Trahe --- drivers/compress/isal/isal_compress_pmd_ops.c | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-) diff --git a/drivers/compress/isal/isal_compress_pmd_ops.c b/drivers/compress/isal/isal_compress_pmd_ops.c index fe99959923..77ac6fcf21 100644 --- a/drivers/compress/isal/isal_compress_pmd_ops.c +++ b/drivers/compress/isal/isal_compress_pmd_ops.c @@ -171,18 +171,12 @@ isal_comp_pmd_qp_release(struct rte_compressdev *dev, uint16_t qp_id) if (qp == NULL) return -EINVAL; - if (qp->stream != NULL) - rte_free(qp->stream); - - if (qp->stream->level_buf != NULL) + if (qp->stream) rte_free(qp->stream->level_buf); - if (qp->state != NULL) - rte_free(qp->state); - - if (qp->processed_pkts != NULL) - rte_ring_free(qp->processed_pkts); - + rte_free(qp->state); + rte_ring_free(qp->processed_pkts); + rte_free(qp->stream); rte_free(qp); dev->data->queue_pairs[qp_id] = NULL; -- 2.20.1