On a failure with the ioat dequeue, -1 is returned, which was not properly
handled. This could lead to out-of-bounds reads on a later loop which
assumed a positive return value. Fix this by treating an error as though a
dequeue of 0 had been encountered.

Coverity issue: 350342
Fixes: 2328542ed84e ("examples/ioat: add rawdev copy mode")

Signed-off-by: Bruce Richardson <bruce.richard...@intel.com>
---
 examples/ioat/ioatfwd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/examples/ioat/ioatfwd.c b/examples/ioat/ioatfwd.c
index 5e623a4d5..9fc033bc3 100644
--- a/examples/ioat/ioatfwd.c
+++ b/examples/ioat/ioatfwd.c
@@ -457,7 +457,7 @@ ioat_tx_port(struct rxtx_port_config *tx_config)
                                MAX_PKT_BURST, NULL);
                }
 
-               if (nb_dq == 0)
+               if (nb_dq <= 0)
                        return;
 
                if (copy_mode == COPY_MODE_IOAT_NUM)
-- 
2.21.0

Reply via email to