Skip to content

eventdev/rxa: fix integer truncation in eth_dev_id validation#117

Open
wapxmas wants to merge 1 commit intoDPDK:mainfrom
wapxmas:tainted-eth_dev_id-fix
Open

eventdev/rxa: fix integer truncation in eth_dev_id validation#117
wapxmas wants to merge 1 commit intoDPDK:mainfrom
wapxmas:tainted-eth_dev_id-fix

Conversation

@wapxmas
Copy link

@wapxmas wapxmas commented Mar 3, 2026

eth_dev_id is declared as int in handle_rxa_get_queue_conf,
handle_rxa_get_queue_stats, handle_rxa_queue_stats_reset, and
handle_rxa_instance_get, but is implicitly narrowed to uint16_t when
passed to rte_eth_dev_is_valid_port via
RTE_EVENT_ETH_RX_ADAPTER_PORTID_VALID_OR_GOTO_ERR_RET. This means
a value like 65535 + N passes validation as N, but is used as-is as
an array index, causing an out-of-bounds access and SIGSEGV.

To reproduce (requires telemetry enabled):

echo "/eventdev/rxa_queue_conf,0,65536,0" | \
  socat - UNIX-CONNECT:/var/run/dpdk/vpp/dpdk_telemetry.v2,type=5

Result:

SIGSEGV at handle_rxa_get_queue_conf + 0x34a, faulting address 0x50

Fix: Change eth_dev_id type from int to uint16_t.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant