eth_memif_tx() reads bufs[0]->pool to pick the mempool for its
single-pool fast-path test, before any check on nb_pkts. A caller that
passes nb_pkts == 0 therefore dereferences bufs[0], out of bounds for an
empty burst. Return early when there is nothing to transmit, after the
ring == NULL check so a secondary process still requests regions.
Fixes: b5613c8f9d0a ("net/memif: add a Tx fast path")
Cc: [email protected]
Signed-off-by: Sriram Yagnaraman <[email protected]>
---
drivers/net/memif/rte_eth_memif.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/memif/rte_eth_memif.c
b/drivers/net/memif/rte_eth_memif.c
index 2d42338e48..2e41eaa459 100644
--- a/drivers/net/memif/rte_eth_memif.c
+++ b/drivers/net/memif/rte_eth_memif.c
@@ -904,6 +904,8 @@ eth_memif_tx(void *queue, struct rte_mbuf **bufs, uint16_t
nb_pkts)
mq->in_port, rte_strerror(-ret));
return 0;
}
+ if (unlikely(nb_pkts == 0))
+ return 0;
ring_size = 1 << mq->log2_ring_size;
mask = ring_size - 1;
--
2.43.7
