zxdh_hw_flow_query() declares its ZXDH_DTB_USER_ENTRY_T without an
initialiser, unlike the sibling declarations in
zxdh_hw_flow_insert() and zxdh_hw_flow_del() which use = {0}. When
the flow index is ZXDH_MAX_FLOW_NUM or more,
zxdh_fd_flow_to_dtbentry() returns before writing the entry, and the
free_res path then calls rte_free() on the uninitialised
p_entry_data pointer. The index comes from a VF's ZXDH_FLOW_HW_GET
mailbox message, and pf_fd_hw_query_count() only checks it after the
query, so a single request from a guest frees garbage and kills the
process driving the PF in a release build.
Initialise the entry the way the siblings do: both error paths
(out-of-range index and rte_zmalloc() failure) then end in
rte_free(NULL), a no-op, and the VF gets the existing error reply.
Valid indices behave as before.
Fixes: d0af48c1b952 ("net/zxdh: support flow API")
Cc: [email protected]
Signed-off-by: Junlong Wang <[email protected]>
---
drivers/net/zxdh/zxdh_flow.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/zxdh/zxdh_flow.c b/drivers/net/zxdh/zxdh_flow.c
index 56ac34c6e3..a51ce9ef77 100644
--- a/drivers/net/zxdh/zxdh_flow.c
+++ b/drivers/net/zxdh/zxdh_flow.c
@@ -1137,7 +1137,7 @@ zxdh_hw_flow_query(struct rte_eth_dev *dev, struct
zxdh_flow *dh_flow,
struct zxdh_hw *hw = dev->data->dev_private;
int ret = 0;
struct zxdh_flow_info *flow = &dh_flow->flowentry;
- ZXDH_DTB_USER_ENTRY_T dtb_entry;
+ ZXDH_DTB_USER_ENTRY_T dtb_entry = {0};
uint16_t handle_idx;
handle_idx = zxdh_fd_flow_to_dtbentry(hw, flow, &dtb_entry);
--
2.27.0
