[PATCH v5 07/22] tailq: fix lookup macro

David Marchand david.marchand at redhat.com
Wed Jul 23 15:31:40 CEST 2025


Doing arithmetic with the NULL pointer is undefined.

Caught by UBSan:

../app/test/test_tailq.c:111:9: runtime error:
	member access within null pointer of type 'struct rte_tailq_head'

Fixes: f6b4f6c9c123 ("tailq: use a single cast macro")
Cc: stable at dpdk.org

Signed-off-by: David Marchand <david.marchand at redhat.com>
---
Changes since v3:
- left the cast macro untouched and fixed the lookup macro instead,

---
 lib/eal/include/rte_tailq.h | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/lib/eal/include/rte_tailq.h b/lib/eal/include/rte_tailq.h
index 89f7ef2134..e7caed6812 100644
--- a/lib/eal/include/rte_tailq.h
+++ b/lib/eal/include/rte_tailq.h
@@ -69,11 +69,12 @@ struct rte_tailq_elem {
  * @return
  *   The return value from rte_eal_tailq_lookup, typecast to the appropriate
  *   structure pointer type.
- *   NULL on error, since the tailq_head is the first
- *   element in the rte_tailq_head structure.
+ *   NULL on error.
  */
-#define RTE_TAILQ_LOOKUP(name, struct_name) \
-	RTE_TAILQ_CAST(rte_eal_tailq_lookup(name), struct_name)
+#define RTE_TAILQ_LOOKUP(name, struct_name) __extension__ ({ \
+	struct rte_tailq_head *head = rte_eal_tailq_lookup(name); \
+	head == NULL ? NULL : RTE_TAILQ_CAST(head, struct_name); \
+})
 
 /**
  * Dump tail queues to a file.
-- 
2.50.0



More information about the dev mailing list