[DPDK/eventdev Bug 2034] eventdev: dangling pointer on error path in rxa_sw_add()

[bugzilla@dpdk.org]

https://bugs.dpdk.org/show_bug.cgi?id=2034

            Bug ID: 2034
           Summary: eventdev: dangling pointer on error path in
                    rxa_sw_add()
           Product: DPDK
           Version: 26.03
          Hardware: All
                OS: All
            Status: UNCONFIRMED
          Severity: normal
          Priority: Normal
         Component: eventdev
          Assignee: dev@dpdk.org
          Reporter: yangshuaisong@h-partners.com
  Target Milestone: ---

[Overview]
A code quality / dangling pointer issue was identified via static analysis in
the eventdev library. In `rxa_sw_add()`, a newly allocated buffer is attached
to a structure pointer before all resource allocations succeed. If a subsequent
allocation fails, the buffer memory is freed, but the structure pointer is not
cleared, leaving a dangling pointer (`queue_info->event_buf`).

[Location]
- File: lib/eventdev/rte_event_eth_rx_adapter.c
- Function: `rxa_sw_add()`
- Lines: 2175, 2181-2187 (or adjacent lines depending on version)

[Environment & Build]
- DPDK Version: [26.03]
- OS / Kernel: Generic
- Tool: Identified via static code analysis / code audit.

[Vulnerability Logic & Analysis]
Looking at the implementation of `rxa_sw_add()`:
1. At line 2175, the newly allocated event buffer `new_rx_buf` is assigned to
the queue information structure:
   ```c
   queue_info->event_buf = new_rx_buf;
   ```
2. Subsequently, at lines 2181-2187, the function attempts to allocate memory
for `stats`. If `stats == NULL` (allocation failure), it rolls back by freeing
the sub-elements and the buffer itself:
   ```c
   if (stats == NULL) {
       rte_free(new_rx_buf->events);
       rte_free(new_rx_buf);
       RTE_EDEV_LOG_ERR(...);
       return -ENOMEM;
   }
   ```
3. However, during this error path and cleanup, `queue_info->event_buf` is
never reset to `NULL`. It retains the memory address of `new_rx_buf` which has
already been freed via `rte_free(new_rx_buf)`.

[Actual Results]
Currently, this does not immediately trigger an exploitable Use-After-Free
(UAF) because the queue is rolled back and not marked as "active/added" in this
specific lifecycle phase. However, leaving a dangling pointer is a classic
anti-pattern that severely damages code robustness. If `queue_info` is reused
or retried in the future, it might lead to a latent Use-After-Free.

[Expected Results]
Pointers should always be safely cleared when the memory they reference is
freed, or resource attachments should only happen after all potential
allocation failures have been safely cleared.

[Suggested Fix]
Option A: Simply reset the pointer to NULL immediately after freeing the memory
in the error block:
```c
if (stats == NULL) {
    rte_free(new_rx_buf->events);
    rte_free(new_rx_buf);
    queue_info->event_buf = NULL; /* Avoid dangling pointer */
    ...
    return -ENOMEM;
}
```

Option B (Preferred): Postpone the pointer assignment until all allocations
(including stats) have fully succeeded:
```c
/* Move this assignment down, after the stats NULL check */
queue_info->event_buf = new_rx_buf;
```

-- 
You are receiving this mail because:
You are the assignee for the bug.