patch 'eventdev/eth_rx: fix crash with telemetry' has been queued to stable release 23.11.7

[Shani Peretz]

Hi,

FYI, your patch has been queued to stable release 23.11.7

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 04/19/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/shanipr/dpdk-stable

This queued commit can be viewed at:
https://github.com/shanipr/dpdk-stable/commit/19fd94acf4f2d7403b8257e3d544b8fe1ec0a60b

Thanks.

Shani

---
>From 19fd94acf4f2d7403b8257e3d544b8fe1ec0a60b Mon Sep 17 00:00:00 2001
From: Sergei Iashin <yashin.sergey at gmail.com>
Date: Wed, 4 Mar 2026 03:34:05 +0300
Subject: [PATCH] eventdev/eth_rx: fix crash with telemetry

[ upstream commit ca972f6c6430775b57f2e7e24d6a568552a9ea81 ]

eth_dev_id is declared as int in handle_rxa_get_queue_conf(),
handle_rxa_get_queue_stats(), handle_rxa_queue_stats_reset(), and
handle_rxa_instance_get(), but is implicitly narrowed to uint16_t when
passed to rte_eth_dev_is_valid_port() via
RTE_EVENT_ETH_RX_ADAPTER_PORTID_VALID_OR_GOTO_ERR_RET().

A value like 65535 + N passes validation as N, but is then used as-is as
an array index, causing out-of-bounds access and SIGSEGV.

To reproduce (requires telemetry enabled):
  echo "/eventdev/rxa_queue_conf,0,65536,0" | \
    socat - UNIX-CONNECT:/var/run/dpdk/vpp/dpdk_telemetry.v2,type=5

Result:
  SIGSEGV at handle_rxa_get_queue_conf + 0x34a, faulting address 0x50

This patch changes eth_dev_id from int to uint16_t to avoid truncation.

Fixes: 74b034ff8172 ("eventdev/eth_rx: fix parameters parsing memory leak")

Signed-off-by: Sergei Iashin <yashin.sergey at gmail.com>
---
 .mailmap                                |  1 +
 lib/eventdev/rte_event_eth_rx_adapter.c | 12 ++++++++----
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/.mailmap b/.mailmap
index 04465f8ded..cbff3e0f45 100644
--- a/.mailmap
+++ b/.mailmap
@@ -1324,6 +1324,7 @@ Sean Morrissey <sean.morrissey at intel.com>
 Sean Zhang <xiazhang at nvidia.com>
 Sebastian Basierski <sebastianx.basierski at intel.com>
 Selwin Sebastian <selwin.sebastian at amd.com>
+Sergei Iashin <yashin.sergey at gmail.com>
 Sergey Balabanov <balabanovsv at ecotelecom.ru>
 Sergey Dyasly <s.dyasly at samsung.com>
 Sergey Madaminov <sergey.madaminov at gmail.com>
diff --git a/lib/eventdev/rte_event_eth_rx_adapter.c b/lib/eventdev/rte_event_eth_rx_adapter.c
index 017b9ca057..5e7e5404aa 100644
--- a/lib/eventdev/rte_event_eth_rx_adapter.c
+++ b/lib/eventdev/rte_event_eth_rx_adapter.c
@@ -3649,7 +3649,8 @@ handle_rxa_get_queue_conf(const char *cmd __rte_unused,
 {
 	uint8_t rx_adapter_id;
 	uint16_t rx_queue_id;
-	int eth_dev_id, ret = -1;
+	uint16_t eth_dev_id;
+	int ret = -1;
 	char *token, *l_params;
 	struct rte_event_eth_rx_adapter_queue_conf queue_conf;
 
@@ -3721,7 +3722,8 @@ handle_rxa_get_queue_stats(const char *cmd __rte_unused,
 {
 	uint8_t rx_adapter_id;
 	uint16_t rx_queue_id;
-	int eth_dev_id, ret = -1;
+	uint16_t eth_dev_id;
+	int ret = -1;
 	char *token, *l_params;
 	struct rte_event_eth_rx_adapter_queue_stats q_stats;
 
@@ -3792,7 +3794,8 @@ handle_rxa_queue_stats_reset(const char *cmd __rte_unused,
 {
 	uint8_t rx_adapter_id;
 	uint16_t rx_queue_id;
-	int eth_dev_id, ret = -1;
+	uint16_t eth_dev_id;
+	int ret = -1;
 	char *token, *l_params;
 
 	if (params == NULL || strlen(params) == 0 || !isdigit(*params))
@@ -3853,7 +3856,8 @@ handle_rxa_instance_get(const char *cmd __rte_unused,
 {
 	uint8_t instance_id;
 	uint16_t rx_queue_id;
-	int eth_dev_id, ret = -1;
+	uint16_t eth_dev_id;
+	int ret = -1;
 	char *token, *l_params;
 
 	if (params == NULL || strlen(params) == 0 || !isdigit(*params))
-- 
2.43.0

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-04-14 14:44:35.715363927 +0300
+++ 0073-eventdev-eth_rx-fix-crash-with-telemetry.patch	2026-04-14 14:44:28.802401000 +0300
@@ -1 +1 @@
-From ca972f6c6430775b57f2e7e24d6a568552a9ea81 Mon Sep 17 00:00:00 2001
+From 19fd94acf4f2d7403b8257e3d544b8fe1ec0a60b Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit ca972f6c6430775b57f2e7e24d6a568552a9ea81 ]
+
@@ -25 +26,0 @@
-Cc: stable at dpdk.org
@@ -34 +35 @@
-index 1d2d2bc7a1..86ea4b481a 100644
+index 04465f8ded..cbff3e0f45 100644
@@ -37 +38 @@
-@@ -1459,6 +1459,7 @@ Sean Morrissey <sean.morrissey at intel.com>
+@@ -1324,6 +1324,7 @@ Sean Morrissey <sean.morrissey at intel.com>
@@ -46 +47 @@
-index d564e14b72..2183adce6f 100644
+index 017b9ca057..5e7e5404aa 100644
@@ -49 +50 @@
-@@ -3827,7 +3827,8 @@ handle_rxa_get_queue_conf(const char *cmd __rte_unused,
+@@ -3649,7 +3649,8 @@ handle_rxa_get_queue_conf(const char *cmd __rte_unused,
@@ -59 +60 @@
-@@ -3899,7 +3900,8 @@ handle_rxa_get_queue_stats(const char *cmd __rte_unused,
+@@ -3721,7 +3722,8 @@ handle_rxa_get_queue_stats(const char *cmd __rte_unused,
@@ -69 +70 @@
-@@ -3970,7 +3972,8 @@ handle_rxa_queue_stats_reset(const char *cmd __rte_unused,
+@@ -3792,7 +3794,8 @@ handle_rxa_queue_stats_reset(const char *cmd __rte_unused,
@@ -79 +80 @@
-@@ -4031,7 +4034,8 @@ handle_rxa_instance_get(const char *cmd __rte_unused,
+@@ -3853,7 +3856,8 @@ handle_rxa_instance_get(const char *cmd __rte_unused,