patch 'eventdev/eth_rx: fix crash with telemetry' has been queued to stable release 25.11.1

Kevin Traynor ktraynor at redhat.com
Fri Mar 27 11:01:19 CET 2026


Hi,

FYI, your patch has been queued to stable release 25.11.1

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 03/31/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/kevintraynor/dpdk-stable

This queued commit can be viewed at:
https://github.com/kevintraynor/dpdk-stable/commit/473c4b5056b0c1672fa69bee815d45d15406482b

Thanks.

Kevin

---
>From 473c4b5056b0c1672fa69bee815d45d15406482b Mon Sep 17 00:00:00 2001
From: Sergei Iashin <yashin.sergey at gmail.com>
Date: Wed, 4 Mar 2026 03:34:05 +0300
Subject: [PATCH] eventdev/eth_rx: fix crash with telemetry

[ upstream commit ca972f6c6430775b57f2e7e24d6a568552a9ea81 ]

eth_dev_id is declared as int in handle_rxa_get_queue_conf(),
handle_rxa_get_queue_stats(), handle_rxa_queue_stats_reset(), and
handle_rxa_instance_get(), but is implicitly narrowed to uint16_t when
passed to rte_eth_dev_is_valid_port() via
RTE_EVENT_ETH_RX_ADAPTER_PORTID_VALID_OR_GOTO_ERR_RET().

A value like 65535 + N passes validation as N, but is then used as-is as
an array index, causing out-of-bounds access and SIGSEGV.

To reproduce (requires telemetry enabled):
  echo "/eventdev/rxa_queue_conf,0,65536,0" | \
    socat - UNIX-CONNECT:/var/run/dpdk/vpp/dpdk_telemetry.v2,type=5

Result:
  SIGSEGV at handle_rxa_get_queue_conf + 0x34a, faulting address 0x50

This patch changes eth_dev_id from int to uint16_t to avoid truncation.

Fixes: 74b034ff8172 ("eventdev/eth_rx: fix parameters parsing memory leak")

Signed-off-by: Sergei Iashin <yashin.sergey at gmail.com>
---
 .mailmap                                |  1 +
 lib/eventdev/rte_event_eth_rx_adapter.c | 12 ++++++++----
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/.mailmap b/.mailmap
index fe6c46488c..bfb6116195 100644
--- a/.mailmap
+++ b/.mailmap
@@ -1456,4 +1456,5 @@ Sean Zhang <xiazhang at nvidia.com>
 Sebastian Basierski <sebastianx.basierski at intel.com>
 Selwin Sebastian <selwin.sebastian at amd.com>
+Sergei Iashin <yashin.sergey at gmail.com>
 Sergey Balabanov <balabanovsv at ecotelecom.ru>
 Sergey Dyasly <s.dyasly at samsung.com>
diff --git a/lib/eventdev/rte_event_eth_rx_adapter.c b/lib/eventdev/rte_event_eth_rx_adapter.c
index d564e14b72..2183adce6f 100644
--- a/lib/eventdev/rte_event_eth_rx_adapter.c
+++ b/lib/eventdev/rte_event_eth_rx_adapter.c
@@ -3828,5 +3828,6 @@ handle_rxa_get_queue_conf(const char *cmd __rte_unused,
 	uint8_t rx_adapter_id;
 	uint16_t rx_queue_id;
-	int eth_dev_id, ret = -1;
+	uint16_t eth_dev_id;
+	int ret = -1;
 	char *token, *l_params;
 	struct rte_event_eth_rx_adapter_queue_conf queue_conf;
@@ -3900,5 +3901,6 @@ handle_rxa_get_queue_stats(const char *cmd __rte_unused,
 	uint8_t rx_adapter_id;
 	uint16_t rx_queue_id;
-	int eth_dev_id, ret = -1;
+	uint16_t eth_dev_id;
+	int ret = -1;
 	char *token, *l_params;
 	struct rte_event_eth_rx_adapter_queue_stats q_stats;
@@ -3971,5 +3973,6 @@ handle_rxa_queue_stats_reset(const char *cmd __rte_unused,
 	uint8_t rx_adapter_id;
 	uint16_t rx_queue_id;
-	int eth_dev_id, ret = -1;
+	uint16_t eth_dev_id;
+	int ret = -1;
 	char *token, *l_params;
 
@@ -4032,5 +4035,6 @@ handle_rxa_instance_get(const char *cmd __rte_unused,
 	uint8_t instance_id;
 	uint16_t rx_queue_id;
-	int eth_dev_id, ret = -1;
+	uint16_t eth_dev_id;
+	int ret = -1;
 	char *token, *l_params;
 
-- 
2.53.0

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-03-27 09:58:26.718621611 +0000
+++ 0019-eventdev-eth_rx-fix-crash-with-telemetry.patch	2026-03-27 09:58:26.147625508 +0000
@@ -1 +1 @@
-From ca972f6c6430775b57f2e7e24d6a568552a9ea81 Mon Sep 17 00:00:00 2001
+From 473c4b5056b0c1672fa69bee815d45d15406482b Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit ca972f6c6430775b57f2e7e24d6a568552a9ea81 ]
+
@@ -25 +26,0 @@
-Cc: stable at dpdk.org
@@ -34 +35 @@
-index 1d2d2bc7a1..86ea4b481a 100644
+index fe6c46488c..bfb6116195 100644
@@ -37 +38 @@
-@@ -1460,4 +1460,5 @@ Sean Zhang <xiazhang at nvidia.com>
+@@ -1456,4 +1456,5 @@ Sean Zhang <xiazhang at nvidia.com>



More information about the stable mailing list