Skip to content

Commit 51a2a58

Browse files
Daniil Iskhakovbruce-richardson
authored andcommitted
net/i40e: validate DDP segment header before use
rte_pmd_i40e_get_ddp_info() retrieves the I40E segment header with i40e_find_segment_in_package(). That helper may return NULL if the segment cannot be found. The returned pointer is validated only in one code path, while other branches use it without checking. This can lead to a NULL pointer dereference when parsing a malformed or incomplete DDP package. Move the NULL check right before the segment usage so it applies to all request types needed. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: edeab74 ("net/i40e: get information about DDP profile") Cc: stable@dpdk.org Signed-off-by: Daniil Agalakov <ade@amicon.ru> Signed-off-by: Daniil Iskhakov <dish@amicon.ru> Acked-by: Bruce Richardson <bruce.richardson@intel.com>
1 parent f90fbc2 commit 51a2a58

2 files changed

Lines changed: 7 additions & 5 deletions

File tree

.mailmap

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -326,6 +326,8 @@ Daniel Mrzyglod <danielx.t.mrzyglod@intel.com>
326326
Daniel Shelepov <dashel@microsoft.com>
327327
Daniel Verkamp <daniel.verkamp@intel.com>
328328
Daniele Di Proietto <ddiproietto@vmware.com>
329+
Daniil Agalakov <ade@amicon.ru>
330+
Daniil Iskhakov <dish@amicon.ru>
329331
Daniil Ushkov <daniil.ushkov@yandex.ru>
330332
Danny Patel <dannyp@marvell.com>
331333
Danny Zhou <danny.zhou@intel.com>

drivers/net/intel/i40e/rte_pmd_i40e.c

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1878,6 +1878,11 @@ int rte_pmd_i40e_get_ddp_info(uint8_t *pkg_buff, uint32_t pkg_size,
18781878
return I40E_SUCCESS;
18791879
}
18801880

1881+
if (!i40e_seg_hdr) {
1882+
PMD_DRV_LOG(ERR, "Failed to find i40e segment header");
1883+
return -EINVAL;
1884+
}
1885+
18811886
/* get i40e segment header info */
18821887
if (type == RTE_PMD_I40E_PKG_INFO_HEADER) {
18831888
struct rte_pmd_i40e_profile_info *info =
@@ -1893,11 +1898,6 @@ int rte_pmd_i40e_get_ddp_info(uint8_t *pkg_buff, uint32_t pkg_size,
18931898
return -EINVAL;
18941899
}
18951900

1896-
if (!i40e_seg_hdr) {
1897-
PMD_DRV_LOG(ERR, "Failed to find i40e segment header");
1898-
return -EINVAL;
1899-
}
1900-
19011901
memset(info, 0, sizeof(struct rte_pmd_i40e_profile_info));
19021902
info->owner = RTE_PMD_I40E_DDP_OWNER_UNKNOWN;
19031903
info->track_id =

0 commit comments

Comments
 (0)