[PATCH] eventdev: fix possible array underflow/overflow

[PATCH] eventdev: fix possible array underflow/overflow

[Bruce Richardson]

If the number of interrupts is zero, then indexing an array by
"nb_rx_intr - 1" will cause an out-of-bounds write  Fix this by putting
in a check that nb_rx_intr > 0 before doing the array write.

Coverity issue: 448870
Fixes: 3810ae435783 ("eventdev: add interrupt driven queues to Rx adapter")
Cc: stable@dpdk.org

Signed-off-by: Bruce Richardson <bruce.richardson@intel.com>
---
 lib/eventdev/rte_event_eth_rx_adapter.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/eventdev/rte_event_eth_rx_adapter.c b/lib/eventdev/rte_event_eth_rx_adapter.c
index 3ee20d95f3..39674c4604 100644
--- a/lib/eventdev/rte_event_eth_rx_adapter.c
+++ b/lib/eventdev/rte_event_eth_rx_adapter.c
@@ -2299,7 +2299,7 @@ rxa_sw_add(struct event_eth_rx_adapter *rx_adapter, uint16_t eth_dev_id,
 			for (i = 0; i < dev_info->dev->data->nb_rx_queues; i++)
 				dev_info->intr_queue[i] = i;
 		} else {
-			if (!rxa_intr_queue(dev_info, rx_queue_id))
+			if (!rxa_intr_queue(dev_info, rx_queue_id) && nb_rx_intr > 0)
 				dev_info->intr_queue[nb_rx_intr - 1] =
 					rx_queue_id;
 		}
-- 
2.43.0

RE: [EXTERNAL] [PATCH] eventdev: fix possible array underflow/overflow

[Jerin Jacob]

> -----Original Message-----
> From: Bruce Richardson <bruce.richardson@intel.com>
> Sent: Thursday, November 14, 2024 5:26 PM
> To: dev@dpdk.org
> Cc: Bruce Richardson <bruce.richardson@intel.com>; stable@dpdk.org; Naga
> Harish K S V <s.v.naga.harish.k@intel.com>; Jerin Jacob <jerinj@marvell.com>;
> Nikhil Rao <nikhil.rao@intel.com>
> Subject: [EXTERNAL] [PATCH] eventdev: fix possible array underflow/overflow
> 
> If the number of interrupts is zero, then indexing an array by "nb_rx_intr - 1"
> will cause an out-of-bounds write Fix this by putting in a check that nb_rx_intr >
> 0 before doing the array write. Coverity issue: 448870 Fixes: 3810ae435783
> 
> If the number of interrupts is zero, then indexing an array by "nb_rx_intr - 1"
> will cause an out-of-bounds write  Fix this by putting in a check that nb_rx_intr
> > 0 before doing the array write.
> 
> Coverity issue: 448870
> Fixes: 3810ae435783 ("eventdev: add interrupt driven queues to Rx adapter")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Bruce Richardson <bruce.richardson@intel.com>

Acked-by: Jerin Jacob <jerinj@marvell.com>
Applied to dpdk-next-eventdev/for-main. Thanks

> ---
>  lib/eventdev/rte_event_eth_rx_adapter.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/lib/eventdev/rte_event_eth_rx_adapter.c
> b/lib/eventdev/rte_event_eth_rx_adapter.c
> index 3ee20d95f3..39674c4604 100644
> --- a/lib/eventdev/rte_event_eth_rx_adapter.c
> +++ b/lib/eventdev/rte_event_eth_rx_adapter.c
> @@ -2299,7 +2299,7 @@ rxa_sw_add(struct event_eth_rx_adapter
> *rx_adapter, uint16_t eth_dev_id,
>  			for (i = 0; i < dev_info->dev->data->nb_rx_queues; i++)
>  				dev_info->intr_queue[i] = i;
>  		} else {
> -			if (!rxa_intr_queue(dev_info, rx_queue_id))
> +			if (!rxa_intr_queue(dev_info, rx_queue_id) &&
> nb_rx_intr > 0)
>  				dev_info->intr_queue[nb_rx_intr - 1] =
>  					rx_queue_id;
>  		}
> --
> 2.43.0