|WARNING| crypto/armv8: validate xform auth key length

[dpdklab at iol.unh.edu]

Test-Label: ai-code-review
Test-Status: WARNING
https://dpdk.org/patch/171175

_AI Code Review_

=== Patch Review: series.patch (via Claude) ===
Review date: 2026-11-02

# DPDK Patch Review

## File: drivers/crypto/armv8/rte_armv8_pmd.c

### ERRORS

**Error 1: Missing check for zero-length key**
Line: `if (xform->auth.key.data == NULL || xform->auth.key.length > SHA_BLOCK_MAX)`

The validation checks for NULL pointer and maximum length, but does not validate minimum length.
A zero-length key would pass this check but is cryptographically invalid for HMAC.
Most crypto PMDs reject zero-length keys.

Suggested fix:
```c
if (xform->auth.key.data == NULL ||
        xform->auth.key.length == 0 ||
        xform->auth.key.length > SHA_BLOCK_MAX) {
    ARMV8_CRYPTO_LOG_ERR("Invalid authentication key provided.");
    return -1;
}
```

**Error 2: Incorrect return value for error condition**
Line: `return -1;`

DPDK convention for crypto PMD configuration failures is to return `-EINVAL` for invalid parameters, not `-1`. The calling code in `rte_cryptodev` expects standard errno values.
Other validation functions in this file (e.g., `armv8_crypto_set_session_chained_parameters`) return `-EINVAL`.

Suggested fix:
```c
ARMV8_CRYPTO_LOG_ERR("Invalid authentication key provided.");
return -EINVAL;
```

### WARNINGS

None.

### INFO

**Info 1: Key validation could check algo-specific constraints**

Different HMAC algorithms have different minimum key length recommendations (e.g., SHA1-HMAC typically uses 20-byte keys, SHA256-HMAC uses 32-byte keys).
The current check only validates against `SHA_BLOCK_MAX` (64 bytes based on typical DPDK crypto definitions).
While the patch correctly prevents buffer overflow, algorithm-specific minimum length validation would be more thorough.
However, since the patch description states the goal is overflow prevention and consistency with other PMDs, this is acceptable as-is.

---

Review-Result: ERROR