[PATCH v1 2/8] net/zxdh: initialise DTB entry in flow query

[Junlong Wang]

zxdh_hw_flow_query() declares its ZXDH_DTB_USER_ENTRY_T without an
initialiser, unlike the sibling declarations in
zxdh_hw_flow_insert() and zxdh_hw_flow_del() which use = {0}. When
the flow index is ZXDH_MAX_FLOW_NUM or more,
zxdh_fd_flow_to_dtbentry() returns before writing the entry, and the
free_res path then calls rte_free() on the uninitialised
p_entry_data pointer. The index comes from a VF's ZXDH_FLOW_HW_GET
mailbox message, and pf_fd_hw_query_count() only checks it after the
query, so a single request from a guest frees garbage and kills the
process driving the PF in a release build.

Initialise the entry the way the siblings do: both error paths
(out-of-range index and rte_zmalloc() failure) then end in
rte_free(NULL), a no-op, and the VF gets the existing error reply.
Valid indices behave as before.

Fixes: d0af48c1b952 ("net/zxdh: support flow API")
Cc: stable at dpdk.org

Signed-off-by: Junlong Wang <wang.junlong1 at zte.com.cn>
---
 drivers/net/zxdh/zxdh_flow.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/zxdh/zxdh_flow.c b/drivers/net/zxdh/zxdh_flow.c
index 56ac34c6e3..a51ce9ef77 100644
--- a/drivers/net/zxdh/zxdh_flow.c
+++ b/drivers/net/zxdh/zxdh_flow.c
@@ -1137,7 +1137,7 @@ zxdh_hw_flow_query(struct rte_eth_dev *dev, struct zxdh_flow *dh_flow,
 	struct zxdh_hw *hw = dev->data->dev_private;
 	int ret = 0;
 	struct zxdh_flow_info *flow = &dh_flow->flowentry;
-	ZXDH_DTB_USER_ENTRY_T dtb_entry;
+	ZXDH_DTB_USER_ENTRY_T dtb_entry = {0};
 	uint16_t handle_idx;
 
 	handle_idx = zxdh_fd_flow_to_dtbentry(hw, flow, &dtb_entry);
-- 
2.27.0
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mails.dpdk.org/archives/stable/attachments/20261107/6b6068f5/attachment.htm>