https://bugs.dpdk.org/show_bug.cgi?id=2034
Bug ID: 2034
Summary: eventdev: dangling pointer on error path in
rxa_sw_add()
Product: DPDK
Version: 26.03
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: Normal
Component: eventdev
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
[Overview]
A code quality / dangling pointer issue was identified via static analysis in
the eventdev library. In `rxa_sw_add()`, a newly allocated buffer is attached
to a structure pointer before all resource allocations succeed. If a subsequent
allocation fails, the buffer memory is freed, but the structure pointer is not
cleared, leaving a dangling pointer (`queue_info->event_buf`).
[Location]
- File: lib/eventdev/rte_event_eth_rx_adapter.c
- Function: `rxa_sw_add()`
- Lines: 2175, 2181-2187 (or adjacent lines depending on version)
[Environment & Build]
- DPDK Version: [26.03]
- OS / Kernel: Generic
- Tool: Identified via static code analysis / code audit.
[Vulnerability Logic & Analysis]
Looking at the implementation of `rxa_sw_add()`:
1. At line 2175, the newly allocated event buffer `new_rx_buf` is assigned to
the queue information structure:
```c
queue_info->event_buf = new_rx_buf;
```
2. Subsequently, at lines 2181-2187, the function attempts to allocate memory
for `stats`. If `stats == NULL` (allocation failure), it rolls back by freeing
the sub-elements and the buffer itself:
```c
if (stats == NULL) {
rte_free(new_rx_buf->events);
rte_free(new_rx_buf);
RTE_EDEV_LOG_ERR(...);
return -ENOMEM;
}
```
3. However, during this error path and cleanup, `queue_info->event_buf` is
never reset to `NULL`. It retains the memory address of `new_rx_buf` which has
already been freed via `rte_free(new_rx_buf)`.
[Actual Results]
Currently, this does not immediately trigger an exploitable Use-After-Free
(UAF) because the queue is rolled back and not marked as "active/added" in this
specific lifecycle phase. However, leaving a dangling pointer is a classic
anti-pattern that severely damages code robustness. If `queue_info` is reused
or retried in the future, it might lead to a latent Use-After-Free.
[Expected Results]
Pointers should always be safely cleared when the memory they reference is
freed, or resource attachments should only happen after all potential
allocation failures have been safely cleared.
[Suggested Fix]
Option A: Simply reset the pointer to NULL immediately after freeing the memory
in the error block:
```c
if (stats == NULL) {
rte_free(new_rx_buf->events);
rte_free(new_rx_buf);
queue_info->event_buf = NULL; /* Avoid dangling pointer */
...
return -ENOMEM;
}
```
Option B (Preferred): Postpone the pointer assignment until all allocations
(including stats) have fully succeeded:
```c
/* Move this assignment down, after the stats NULL check */
queue_info->event_buf = new_rx_buf;
```
--
You are receiving this mail because:
You are the assignee for the bug.
