On a failure with the ioat dequeue, -1 is returned, which was not properly handled. This could lead to out-of-bounds reads on a later loop which assumed a positive return value. Fix this by treating an error as though a dequeue of 0 had been encountered.
Coverity issue: 350342 Fixes: 2328542ed84e ("examples/ioat: add rawdev copy mode") Signed-off-by: Bruce Richardson <bruce.richard...@intel.com> --- examples/ioat/ioatfwd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/examples/ioat/ioatfwd.c b/examples/ioat/ioatfwd.c index 5e623a4d5..9fc033bc3 100644 --- a/examples/ioat/ioatfwd.c +++ b/examples/ioat/ioatfwd.c @@ -457,7 +457,7 @@ ioat_tx_port(struct rxtx_port_config *tx_config) MAX_PKT_BURST, NULL); } - if (nb_dq == 0) + if (nb_dq <= 0) return; if (copy_mode == COPY_MODE_IOAT_NUM) -- 2.21.0