patch 'eventdev: fix possible array underflow/overflow' has been queued to stable release 22.11.7

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 22.11.7

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 11/22/24. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/af71652ab753ab73541c70000d74a3224a2e5df7

Thanks.

Luca Boccassi

---
>From af71652ab753ab73541c70000d74a3224a2e5df7 Mon Sep 17 00:00:00 2001
From: Bruce Richardson <bruce.richardson at intel.com>
Date: Thu, 14 Nov 2024 11:55:38 +0000
Subject: [PATCH] eventdev: fix possible array underflow/overflow

[ upstream commit 952b24bd0475450e548d4aafae7d8cf48258402b ]

If the number of interrupts is zero, then indexing an array by
"nb_rx_intr - 1" will cause an out-of-bounds write  Fix this by putting
in a check that nb_rx_intr > 0 before doing the array write.

Coverity issue: 448870
Fixes: 3810ae435783 ("eventdev: add interrupt driven queues to Rx adapter")

Signed-off-by: Bruce Richardson <bruce.richardson at intel.com>
Acked-by: Jerin Jacob <jerinj at marvell.com>
---
 lib/eventdev/rte_event_eth_rx_adapter.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/eventdev/rte_event_eth_rx_adapter.c b/lib/eventdev/rte_event_eth_rx_adapter.c
index b4f05f250c..bd971fb63a 100644
--- a/lib/eventdev/rte_event_eth_rx_adapter.c
+++ b/lib/eventdev/rte_event_eth_rx_adapter.c
@@ -2293,7 +2293,7 @@ rxa_sw_add(struct event_eth_rx_adapter *rx_adapter, uint16_t eth_dev_id,
 			for (i = 0; i < dev_info->dev->data->nb_rx_queues; i++)
 				dev_info->intr_queue[i] = i;
 		} else {
-			if (!rxa_intr_queue(dev_info, rx_queue_id))
+			if (!rxa_intr_queue(dev_info, rx_queue_id) && nb_rx_intr > 0)
 				dev_info->intr_queue[nb_rx_intr - 1] =
 					rx_queue_id;
 		}
-- 
2.45.2

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2024-11-20 23:41:23.166425319 +0000
+++ 0013-eventdev-fix-possible-array-underflow-overflow.patch	2024-11-20 23:41:22.708195467 +0000
@@ -1 +1 @@
-From 952b24bd0475450e548d4aafae7d8cf48258402b Mon Sep 17 00:00:00 2001
+From af71652ab753ab73541c70000d74a3224a2e5df7 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 952b24bd0475450e548d4aafae7d8cf48258402b ]
+
@@ -12 +13,0 @@
-Cc: stable at dpdk.org
@@ -21 +22 @@
-index 3ee20d95f3..39674c4604 100644
+index b4f05f250c..bd971fb63a 100644
@@ -24 +25 @@
-@@ -2299,7 +2299,7 @@ rxa_sw_add(struct event_eth_rx_adapter *rx_adapter, uint16_t eth_dev_id,
+@@ -2293,7 +2293,7 @@ rxa_sw_add(struct event_eth_rx_adapter *rx_adapter, uint16_t eth_dev_id,