[PATCH 1/6] net/memif: guard against empty Tx burst

[Sriram Yagnaraman]

eth_memif_tx() reads bufs[0]->pool before any check on nb_pkts, to pick
the mempool for its fast-path single-pool test. A caller that passes
nb_pkts == 0 therefore dereferences bufs[0], which is out of bounds for
an empty burst. Return early when there is nothing to transmit.

Fixes: 09c7e63a71f9 ("net/memif: introduce memory interface PMD")
Cc: stable at dpdk.org

Signed-off-by: Sriram Yagnaraman <sriram.yagnaraman at ericsson.com>
---
 drivers/net/memif/rte_eth_memif.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/memif/rte_eth_memif.c b/drivers/net/memif/rte_eth_memif.c
index 2d42338e48..5e28db782d 100644
--- a/drivers/net/memif/rte_eth_memif.c
+++ b/drivers/net/memif/rte_eth_memif.c
@@ -894,6 +894,8 @@ eth_memif_tx(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts)
 
 	if (unlikely((pmd->flags & ETH_MEMIF_FLAG_CONNECTED) == 0))
 		return 0;
+	if (unlikely(nb_pkts == 0))
+		return 0;
 	if (unlikely(ring == NULL)) {
 		int ret;
 
-- 
2.43.7