From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mga11.intel.com (mga11.intel.com [192.55.52.93]) by dpdk.org (Postfix) with ESMTP id DCC61201; Mon, 12 Nov 2018 10:49:45 +0100 (CET) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga003.fm.intel.com ([10.253.24.29]) by fmsmga102.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 12 Nov 2018 01:49:45 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.54,494,1534834800"; d="scan'208";a="95633417" Received: from dpdk6.bj.intel.com ([172.16.182.192]) by FMSMGA003.fm.intel.com with ESMTP; 12 Nov 2018 01:49:43 -0800 From: Wei Zhao To: dev@dpdk.org Cc: qi.z.zhang@intel.com, stable@dpdk.org, yuan.peng@intel.com, Wei Zhao Date: Mon, 12 Nov 2018 17:25:24 +0800 Message-Id: <1542014724-68073-1-git-send-email-wei.zhao1@intel.com> X-Mailer: git-send-email 2.7.5 Subject: [dpdk-dev] [PATCH] net/i40e: add parameter check for RSS flow init X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Nov 2018 09:49:46 -0000 There need an parameter check for RSS flow init, or it may cause core dump if pointer is NULL in memory copy. Fixes: ac8d22de2394 ("ethdev: flatten RSS configuration in flow API") Signed-off-by: Wei Zhao --- drivers/net/i40e/i40e_ethdev.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/net/i40e/i40e_ethdev.c b/drivers/net/i40e/i40e_ethdev.c index 1c77906..217a8dc 100644 --- a/drivers/net/i40e/i40e_ethdev.c +++ b/drivers/net/i40e/i40e_ethdev.c @@ -12552,13 +12552,16 @@ i40e_rss_conf_init(struct i40e_rte_flow_rss_conf *out, if (in->key_len > RTE_DIM(out->key) || in->queue_num > RTE_DIM(out->queue)) return -EINVAL; + if (!in->key && in->key_len) + return -EINVAL; + if (out->key && in->key) + out->conf.key = memcpy(out->key, in->key, in->key_len); out->conf = (struct rte_flow_action_rss){ .func = in->func, .level = in->level, .types = in->types, .key_len = in->key_len, .queue_num = in->queue_num, - .key = memcpy(out->key, in->key, in->key_len), .queue = memcpy(out->queue, in->queue, sizeof(*in->queue) * in->queue_num), }; -- 2.7.5