net/sfc: fix NULL dereference in EF10 TSO if no payload
Checks
Commit Message
From: Igor Romanov <igor.romanov@oktetlabs.ru>
Fixes: 6bc985e41155 ("net/sfc: support TSO in EF10 Tx datapath")
Cc: stable@dpdk.org
Signed-off-by: Igor Romanov <igor.romanov@oktetlabs.ru>
Signed-off-by: Andrew Rybchenko <arybchenko@solarflare.com>
---
There are a couple of warnings generated by checkpatches.sh which are
OK since positive errors are used inside PMD (since positive error
codes are used in base driver).
drivers/net/sfc/sfc_ef10_tx.c | 7 +++++++
1 file changed, 7 insertions(+)
Comments
On 1/23/2019 1:08 PM, Andrew Rybchenko wrote:
> From: Igor Romanov <igor.romanov@oktetlabs.ru>
>
> Fixes: 6bc985e41155 ("net/sfc: support TSO in EF10 Tx datapath")
> Cc: stable@dpdk.org
>
> Signed-off-by: Igor Romanov <igor.romanov@oktetlabs.ru>
> Signed-off-by: Andrew Rybchenko <arybchenko@solarflare.com>
Applied to dpdk-next-net/master, thanks.
@@ -381,6 +381,9 @@ sfc_ef10_xmit_tso_pkt(struct sfc_ef10_txq * const txq, struct rte_mbuf *m_seg,
hdr_addr = rte_pktmbuf_mtod(m_seg, uint8_t *);
hdr_iova = rte_mbuf_data_iova(m_seg);
if (rte_pktmbuf_data_len(m_seg) == header_len) {
+ /* Cannot send a packet that consists only of header */
+ if (unlikely(m_seg->next == NULL))
+ return EMSGSIZE;
/*
* Associate header mbuf with header descriptor
* which is located after TSO descriptors.
@@ -409,6 +412,10 @@ sfc_ef10_xmit_tso_pkt(struct sfc_ef10_txq * const txq, struct rte_mbuf *m_seg,
copied_segs = sfc_tso_prepare_header(hdr_addr, header_len,
&m_seg, &in_off);
+ /* Cannot send a packet that consists only of header */
+ if (unlikely(m_seg == NULL))
+ return EMSGSIZE;
+
m_seg_to_free_up_to = m_seg;
/*
* Reduce the number of needed descriptors by the number of