[PATCH v1] eventdev/eth_rx: fix null pointer dereference

Ganapati Kundapura ganapati.kundapura at intel.com
Thu Aug 24 10:23:31 CEST 2023


On passing NULL as a last parameter to xxx_create_ext_with_params(),
rxa_config_params_validate() uses default values and dereferences
NULL pointer leading to segmentation fault.

Fixed by returning after using default values without dereferencing
NULL pointer.

Fixes: 8be6c94d6d90 ("eventdev/eth_rx: add new adapter create API")

Signed-off-by: Ganapati Kundapura <ganapati.kundapura at intel.com>

diff --git a/app/test/test_event_eth_rx_adapter.c b/app/test/test_event_eth_rx_adapter.c
index 2d5e197666..0233c87779 100644
--- a/app/test/test_event_eth_rx_adapter.c
+++ b/app/test/test_event_eth_rx_adapter.c
@@ -407,6 +407,12 @@ adapter_create(void)
 	return err;
 }
 
+static void
+adapter_free(void)
+{
+	rte_event_eth_rx_adapter_free(TEST_INST_ID);
+}
+
 static int
 adapter_create_with_params(void)
 {
@@ -427,6 +433,13 @@ adapter_create_with_params(void)
 	rxa_params.use_queue_event_buf = false;
 	rxa_params.event_buf_size = 0;
 
+	/* Pass rxa_params = NULL */
+	err = rte_event_eth_rx_adapter_create_with_params(TEST_INST_ID,
+				TEST_DEV_ID, &rx_p_conf, NULL);
+	TEST_ASSERT(err == 0, "Expected 0 got %d", err);
+	if (err == 0)
+		adapter_free();
+
 	err = rte_event_eth_rx_adapter_create_with_params(TEST_INST_ID,
 				TEST_DEV_ID, &rx_p_conf, &rxa_params);
 	TEST_ASSERT(err == -EINVAL, "Expected -EINVAL got %d", err);
@@ -512,6 +525,13 @@ adapter_create_ext_with_params(void)
 	rxa_params.use_queue_event_buf = false;
 	rxa_params.event_buf_size = 0;
 
+	/* Pass rxa_params = NULL */
+	err = rte_event_eth_rx_adapter_create_ext_with_params(TEST_INST_ID,
+			TEST_DEV_ID, test_port_conf_cb, NULL, NULL);
+	TEST_ASSERT(err == 0, "Expected 0 got %d", err);
+	if (err == 0)
+		adapter_free();
+
 	err = rte_event_eth_rx_adapter_create_ext_with_params(TEST_INST_ID,
 			TEST_DEV_ID, test_port_conf_cb, NULL, &rxa_params);
 	TEST_ASSERT(err == -EINVAL, "Expected -EINVAL got %d", err);
@@ -634,12 +654,6 @@ adapter_queue_stats_test(void)
 	return TEST_SUCCESS;
 }
 
-static void
-adapter_free(void)
-{
-	rte_event_eth_rx_adapter_free(TEST_INST_ID);
-}
-
 static int
 adapter_create_free(void)
 {
diff --git a/lib/eventdev/rte_event_eth_rx_adapter.c b/lib/eventdev/rte_event_eth_rx_adapter.c
index 93bed18e93..fe84471523 100644
--- a/lib/eventdev/rte_event_eth_rx_adapter.c
+++ b/lib/eventdev/rte_event_eth_rx_adapter.c
@@ -2493,6 +2493,7 @@ rxa_config_params_validate(struct rte_event_eth_rx_adapter_params *rxa_params,
 		/* use default values if rxa_params is NULL */
 		temp_params->event_buf_size = ETH_EVENT_BUFFER_SIZE;
 		temp_params->use_queue_event_buf = false;
+		return 0;
 	} else if (!rxa_params->use_queue_event_buf &&
 		    rxa_params->event_buf_size == 0) {
 		RTE_EDEV_LOG_ERR("event buffer size can't be zero\n");
-- 
2.23.0



More information about the dev mailing list