eth_memif_tx() reads bufs[0]->pool before any check on nb_pkts, to pick
the mempool for its fast-path single-pool test. A caller that passes
nb_pkts == 0 therefore dereferences bufs[0], which is out of bounds for
an empty burst. Return early when there is nothing to transmit.
Fixes: 09c7e63a71f9 ("net/memif: introduce memory interface PMD")
Cc: [email protected]
Signed-off-by: Sriram Yagnaraman <[email protected]>
---
drivers/net/memif/rte_eth_memif.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/memif/rte_eth_memif.c
b/drivers/net/memif/rte_eth_memif.c
index 2d42338e48..5e28db782d 100644
--- a/drivers/net/memif/rte_eth_memif.c
+++ b/drivers/net/memif/rte_eth_memif.c
@@ -894,6 +894,8 @@ eth_memif_tx(void *queue, struct rte_mbuf **bufs, uint16_t
nb_pkts)
if (unlikely((pmd->flags & ETH_MEMIF_FLAG_CONNECTED) == 0))
return 0;
+ if (unlikely(nb_pkts == 0))
+ return 0;
if (unlikely(ring == NULL)) {
int ret;
--
2.43.7
