patch 'eventdev/eth_rx: fix crash with telemetry' has been queued to stable release 24.11.5

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.5

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 03/28/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/7091cd91b0d3000cdaf89ef1ed0efe655c67bdb8

Thanks.

Luca Boccassi

---
>From 7091cd91b0d3000cdaf89ef1ed0efe655c67bdb8 Mon Sep 17 00:00:00 2001
From: Sergei Iashin <yashin.sergey at gmail.com>
Date: Wed, 4 Mar 2026 03:34:05 +0300
Subject: [PATCH] eventdev/eth_rx: fix crash with telemetry

[ upstream commit ca972f6c6430775b57f2e7e24d6a568552a9ea81 ]

eth_dev_id is declared as int in handle_rxa_get_queue_conf(),
handle_rxa_get_queue_stats(), handle_rxa_queue_stats_reset(), and
handle_rxa_instance_get(), but is implicitly narrowed to uint16_t when
passed to rte_eth_dev_is_valid_port() via
RTE_EVENT_ETH_RX_ADAPTER_PORTID_VALID_OR_GOTO_ERR_RET().

A value like 65535 + N passes validation as N, but is then used as-is as
an array index, causing out-of-bounds access and SIGSEGV.

To reproduce (requires telemetry enabled):
  echo "/eventdev/rxa_queue_conf,0,65536,0" | \
    socat - UNIX-CONNECT:/var/run/dpdk/vpp/dpdk_telemetry.v2,type=5

Result:
  SIGSEGV at handle_rxa_get_queue_conf + 0x34a, faulting address 0x50

This patch changes eth_dev_id from int to uint16_t to avoid truncation.

Fixes: 74b034ff8172 ("eventdev/eth_rx: fix parameters parsing memory leak")

Signed-off-by: Sergei Iashin <yashin.sergey at gmail.com>
---
 .mailmap                                |  1 +
 lib/eventdev/rte_event_eth_rx_adapter.c | 12 ++++++++----
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/.mailmap b/.mailmap
index ee1a2c8766..eadb404f29 100644
--- a/.mailmap
+++ b/.mailmap
@@ -1400,6 +1400,7 @@ Sean Morrissey <sean.morrissey at intel.com>
 Sean Zhang <xiazhang at nvidia.com>
 Sebastian Basierski <sebastianx.basierski at intel.com>
 Selwin Sebastian <selwin.sebastian at amd.com>
+Sergei Iashin <yashin.sergey at gmail.com>
 Sergey Balabanov <balabanovsv at ecotelecom.ru>
 Sergey Dyasly <s.dyasly at samsung.com>
 Sergey Madaminov <sergey.madaminov at gmail.com>
diff --git a/lib/eventdev/rte_event_eth_rx_adapter.c b/lib/eventdev/rte_event_eth_rx_adapter.c
index b5a2c25bfc..4deec1669e 100644
--- a/lib/eventdev/rte_event_eth_rx_adapter.c
+++ b/lib/eventdev/rte_event_eth_rx_adapter.c
@@ -3649,7 +3649,8 @@ handle_rxa_get_queue_conf(const char *cmd __rte_unused,
 {
 	uint8_t rx_adapter_id;
 	uint16_t rx_queue_id;
-	int eth_dev_id, ret = -1;
+	uint16_t eth_dev_id;
+	int ret = -1;
 	char *token, *l_params;
 	struct rte_event_eth_rx_adapter_queue_conf queue_conf;
 
@@ -3721,7 +3722,8 @@ handle_rxa_get_queue_stats(const char *cmd __rte_unused,
 {
 	uint8_t rx_adapter_id;
 	uint16_t rx_queue_id;
-	int eth_dev_id, ret = -1;
+	uint16_t eth_dev_id;
+	int ret = -1;
 	char *token, *l_params;
 	struct rte_event_eth_rx_adapter_queue_stats q_stats;
 
@@ -3792,7 +3794,8 @@ handle_rxa_queue_stats_reset(const char *cmd __rte_unused,
 {
 	uint8_t rx_adapter_id;
 	uint16_t rx_queue_id;
-	int eth_dev_id, ret = -1;
+	uint16_t eth_dev_id;
+	int ret = -1;
 	char *token, *l_params;
 
 	if (params == NULL || strlen(params) == 0 || !isdigit(*params))
@@ -3853,7 +3856,8 @@ handle_rxa_instance_get(const char *cmd __rte_unused,
 {
 	uint8_t instance_id;
 	uint16_t rx_queue_id;
-	int eth_dev_id, ret = -1;
+	uint16_t eth_dev_id;
+	int ret = -1;
 	char *token, *l_params;
 
 	if (params == NULL || strlen(params) == 0 || !isdigit(*params))
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-03-26 12:56:34.058410710 +0000
+++ 0015-eventdev-eth_rx-fix-crash-with-telemetry.patch	2026-03-26 12:56:33.445543941 +0000
@@ -1 +1 @@
-From ca972f6c6430775b57f2e7e24d6a568552a9ea81 Mon Sep 17 00:00:00 2001
+From 7091cd91b0d3000cdaf89ef1ed0efe655c67bdb8 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit ca972f6c6430775b57f2e7e24d6a568552a9ea81 ]
+
@@ -25 +26,0 @@
-Cc: stable at dpdk.org
@@ -34 +35 @@
-index 1d2d2bc7a1..86ea4b481a 100644
+index ee1a2c8766..eadb404f29 100644
@@ -37 +38 @@
-@@ -1459,6 +1459,7 @@ Sean Morrissey <sean.morrissey at intel.com>
+@@ -1400,6 +1400,7 @@ Sean Morrissey <sean.morrissey at intel.com>
@@ -46 +47 @@
-index d564e14b72..2183adce6f 100644
+index b5a2c25bfc..4deec1669e 100644
@@ -49 +50 @@
-@@ -3827,7 +3827,8 @@ handle_rxa_get_queue_conf(const char *cmd __rte_unused,
+@@ -3649,7 +3649,8 @@ handle_rxa_get_queue_conf(const char *cmd __rte_unused,
@@ -59 +60 @@
-@@ -3899,7 +3900,8 @@ handle_rxa_get_queue_stats(const char *cmd __rte_unused,
+@@ -3721,7 +3722,8 @@ handle_rxa_get_queue_stats(const char *cmd __rte_unused,
@@ -69 +70 @@
-@@ -3970,7 +3972,8 @@ handle_rxa_queue_stats_reset(const char *cmd __rte_unused,
+@@ -3792,7 +3794,8 @@ handle_rxa_queue_stats_reset(const char *cmd __rte_unused,
@@ -79 +80 @@
-@@ -4031,7 +4034,8 @@ handle_rxa_instance_get(const char *cmd __rte_unused,
+@@ -3853,7 +3856,8 @@ handle_rxa_instance_get(const char *cmd __rte_unused,