From 91f6ce93be36b0ce3e7eaee0afb194c4b9474320 Mon Sep 17 00:00:00 2001 From: Naga Harish K S V Date: Tue, 9 Nov 2021 01:33:33 -0600 Subject: [PATCH] eventdev/eth_tx: fix queue delete logic [ upstream commit 741b499e6421ff93542d17c57f536b9d8e9bb443 ] This patch fixes heap-use-after-free reported by ASan. The application can use the queue_id as `-1` to delete all the queues of the eth_device that are added to tx_adapter instance. In above case, the queue_del API is trying to use number of queues from adapter level instead of eth_device queues. When there are queues added from multiple eth devices, it will result in heap-use-after-free as reported by ASAN. This patch fixes the queue_del API to use correct number of queues. Bugzilla ID: 869 Fixes: a3bbf2e09756 ("eventdev: add eth Tx adapter implementation") Signed-off-by: Naga Harish K S V Acked-by: Jay Jayatheerthan Tested-by: David Marchand --- lib/librte_eventdev/rte_event_eth_tx_adapter.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/librte_eventdev/rte_event_eth_tx_adapter.c b/lib/librte_eventdev/rte_event_eth_tx_adapter.c index 88abd45d17..e4dbae7bc5 100644 --- a/lib/librte_eventdev/rte_event_eth_tx_adapter.c +++ b/lib/librte_eventdev/rte_event_eth_tx_adapter.c @@ -817,7 +817,7 @@ txa_service_queue_del(uint8_t id, uint16_t i, q, nb_queues; int ret = 0; - nb_queues = txa->nb_queues; + nb_queues = txa->txa_ethdev[port_id].nb_queues; if (nb_queues == 0) return 0;