[dpdk-dev] [PATCH] net/sfc: fix NULL dereference in EF10 TSO if no payload

[Andrew Rybchenko]

From: Igor Romanov <igor.romanov at oktetlabs.ru>

Fixes: 6bc985e41155 ("net/sfc: support TSO in EF10 Tx datapath")
Cc: stable at dpdk.org

Signed-off-by: Igor Romanov <igor.romanov at oktetlabs.ru>
Signed-off-by: Andrew Rybchenko <arybchenko at solarflare.com>
---
There are a couple of warnings generated by checkpatches.sh which are
OK since positive errors are used inside PMD (since positive error
codes are used in base driver).

 drivers/net/sfc/sfc_ef10_tx.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/net/sfc/sfc_ef10_tx.c b/drivers/net/sfc/sfc_ef10_tx.c
index bcd3153ff..ff6d5b486 100644
--- a/drivers/net/sfc/sfc_ef10_tx.c
+++ b/drivers/net/sfc/sfc_ef10_tx.c
@@ -381,6 +381,9 @@ sfc_ef10_xmit_tso_pkt(struct sfc_ef10_txq * const txq, struct rte_mbuf *m_seg,
 		hdr_addr = rte_pktmbuf_mtod(m_seg, uint8_t *);
 		hdr_iova = rte_mbuf_data_iova(m_seg);
 		if (rte_pktmbuf_data_len(m_seg) == header_len) {
+			/* Cannot send a packet that consists only of header */
+			if (unlikely(m_seg->next == NULL))
+				return EMSGSIZE;
 			/*
 			 * Associate header mbuf with header descriptor
 			 * which is located after TSO descriptors.
@@ -409,6 +412,10 @@ sfc_ef10_xmit_tso_pkt(struct sfc_ef10_txq * const txq, struct rte_mbuf *m_seg,
 		copied_segs = sfc_tso_prepare_header(hdr_addr, header_len,
 						     &m_seg, &in_off);
 
+		/* Cannot send a packet that consists only of header */
+		if (unlikely(m_seg == NULL))
+			return EMSGSIZE;
+
 		m_seg_to_free_up_to = m_seg;
 		/*
 		 * Reduce the number of needed descriptors by the number of
-- 
2.17.1