[PATCH] app/testpmd: fix flex item link parsing

[PATCH] app/testpmd: fix flex item link parsing

[Maayan Kashani]

The flex_link_item_parse function was using FLEX_MAX_FLOW_PATTERN_LENGTH
for all memcpy operations regardless of the actual flow item type. This
could lead to copying incorrect amounts of data.

This patch adds a switch statement to determine the correct size based
on the actual flow item type (IPv4, IPv6, UDP, TCP) and uses that size
for the memcpy operations on spec, mask, and last fields.

Also adds validation to reject unsupported item types.

Fixes: 59f3a8acbcdb ("app/testpmd: add flex item commands")
Cc: stable@dpdk.org

Signed-off-by: Maayan Kashani <mkashani@nvidia.com>
---
 app/test-pmd/cmd_flex_item.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/app/test-pmd/cmd_flex_item.c b/app/test-pmd/cmd_flex_item.c
index e6e1cefeb3d..ec19ab63e75 100644
--- a/app/test-pmd/cmd_flex_item.c
+++ b/app/test-pmd/cmd_flex_item.c
@@ -134,6 +134,7 @@ flex_link_item_parse(const char *src, struct rte_flow_item *item)
 	struct rte_flow_attr *attr;
 	struct rte_flow_item *pattern;
 	struct rte_flow_action *actions;
+	size_t sz = 0;
 
 	sprintf(flow_rule,
 		"flow create 0 pattern %s / end actions drop / end", src);
@@ -143,21 +144,24 @@ flex_link_item_parse(const char *src, struct rte_flow_item *item)
 	if (ret)
 		return ret;
 	item->type = pattern->type;
+	ret = rte_flow_conv(RTE_FLOW_CONV_OP_ITEM_MASK, NULL, 0, item, NULL);
+	if (ret > 0)
+		sz = ret;
 	if (pattern->spec) {
 		ptr = (void *)(uintptr_t)item->spec;
-		memcpy(ptr, pattern->spec, FLEX_MAX_FLOW_PATTERN_LENGTH);
+		memcpy(ptr, pattern->spec, sz);
 	} else {
 		item->spec = NULL;
 	}
 	if (pattern->mask) {
 		ptr = (void *)(uintptr_t)item->mask;
-		memcpy(ptr, pattern->mask, FLEX_MAX_FLOW_PATTERN_LENGTH);
+		memcpy(ptr, pattern->mask, sz);
 	} else {
 		item->mask = NULL;
 	}
 	if (pattern->last) {
 		ptr = (void *)(uintptr_t)item->last;
-		memcpy(ptr, pattern->last, FLEX_MAX_FLOW_PATTERN_LENGTH);
+		memcpy(ptr, pattern->last, sz);
 	} else {
 		item->last = NULL;
 	}
-- 
2.21.0

Re: [PATCH] app/testpmd: fix flex item link parsing

[Stephen Hemminger]

On Thu, 13 Nov 2025 22:17:25 +0200
Maayan Kashani <mkashani@nvidia.com> wrote:

> The flex_link_item_parse function was using FLEX_MAX_FLOW_PATTERN_LENGTH
> for all memcpy operations regardless of the actual flow item type. This
> could lead to copying incorrect amounts of data.
> 
> This patch adds a switch statement to determine the correct size based
> on the actual flow item type (IPv4, IPv6, UDP, TCP) and uses that size
> for the memcpy operations on spec, mask, and last fields.
> 
> Also adds validation to reject unsupported item types.
> 
> Fixes: 59f3a8acbcdb ("app/testpmd: add flex item commands")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Maayan Kashani <mkashani@nvidia.com>
> ---
>  app/test-pmd/cmd_flex_item.c | 10 +++++++---
>  1 file changed, 7 insertions(+), 3 deletions(-)
> 
> diff --git a/app/test-pmd/cmd_flex_item.c b/app/test-pmd/cmd_flex_item.c
> index e6e1cefeb3d..ec19ab63e75 100644
> --- a/app/test-pmd/cmd_flex_item.c
> +++ b/app/test-pmd/cmd_flex_item.c
> @@ -134,6 +134,7 @@ flex_link_item_parse(const char *src, struct rte_flow_item *item)
>  	struct rte_flow_attr *attr;
>  	struct rte_flow_item *pattern;
>  	struct rte_flow_action *actions;
> +	size_t sz = 0;
>  
>  	sprintf(flow_rule,
>  		"flow create 0 pattern %s / end actions drop / end", src);
> @@ -143,21 +144,24 @@ flex_link_item_parse(const char *src, struct rte_flow_item *item)
>  	if (ret)
>  		return ret;
>  	item->type = pattern->type;
> +	ret = rte_flow_conv(RTE_FLOW_CONV_OP_ITEM_MASK, NULL, 0, item, NULL);
> +	if (ret > 0)
> +		sz = ret;

You don't really need a temporary variable sz, can't you just use the
return value directly or are you concerned about signed/unsigned mismatch.
If concerned about signed/unsigned mismatch warnings then would need
cast on the assignment to sz.

RE: [PATCH] app/testpmd: fix flex item link parsing

[Maayan Kashani]

Thanks Stephen, 
I'll send v2 with required change.

Regards,
Maayan Kashani

> -----Original Message-----
> From: Stephen Hemminger <stephen@networkplumber.org>
> Sent: Friday, 14 November 2025 0:38
> To: Maayan Kashani <mkashani@nvidia.com>
> Cc: dev@dpdk.org; Raslan Darawsheh <rasland@nvidia.com>;
> stable@dpdk.org; Aman Singh <aman.deep.singh@intel.com>; Slava
> Ovsiienko <viacheslavo@nvidia.com>; Gregory Etelson
> <getelson@nvidia.com>
> Subject: Re: [PATCH] app/testpmd: fix flex item link parsing
> 
> External email: Use caution opening links or attachments
> 
> 
> On Thu, 13 Nov 2025 22:17:25 +0200
> Maayan Kashani <mkashani@nvidia.com> wrote:
> 
> > The flex_link_item_parse function was using
> > FLEX_MAX_FLOW_PATTERN_LENGTH for all memcpy operations regardless
> of
> > the actual flow item type. This could lead to copying incorrect amounts of
> data.
> >
> > This patch adds a switch statement to determine the correct size based
> > on the actual flow item type (IPv4, IPv6, UDP, TCP) and uses that size
> > for the memcpy operations on spec, mask, and last fields.
> >
> > Also adds validation to reject unsupported item types.
> >
> > Fixes: 59f3a8acbcdb ("app/testpmd: add flex item commands")
> > Cc: stable@dpdk.org
> >
> > Signed-off-by: Maayan Kashani <mkashani@nvidia.com>
> > ---
> >  app/test-pmd/cmd_flex_item.c | 10 +++++++---
> >  1 file changed, 7 insertions(+), 3 deletions(-)
> >
> > diff --git a/app/test-pmd/cmd_flex_item.c
> > b/app/test-pmd/cmd_flex_item.c index e6e1cefeb3d..ec19ab63e75 100644
> > --- a/app/test-pmd/cmd_flex_item.c
> > +++ b/app/test-pmd/cmd_flex_item.c
> > @@ -134,6 +134,7 @@ flex_link_item_parse(const char *src, struct
> rte_flow_item *item)
> >       struct rte_flow_attr *attr;
> >       struct rte_flow_item *pattern;
> >       struct rte_flow_action *actions;
> > +     size_t sz = 0;
> >
> >       sprintf(flow_rule,
> >               "flow create 0 pattern %s / end actions drop / end",
> > src); @@ -143,21 +144,24 @@ flex_link_item_parse(const char *src, struct
> rte_flow_item *item)
> >       if (ret)
> >               return ret;
> >       item->type = pattern->type;
> > +     ret = rte_flow_conv(RTE_FLOW_CONV_OP_ITEM_MASK, NULL, 0, item,
> NULL);
> > +     if (ret > 0)
> > +             sz = ret;
> 
> You don't really need a temporary variable sz, can't you just use the return
> value directly or are you concerned about signed/unsigned mismatch.
> If concerned about signed/unsigned mismatch warnings then would need
> cast on the assignment to sz.

[PATCH v2] app/testpmd: fix flex item link parsing

[Maayan Kashani]

The flex_link_item_parse function was using FLEX_MAX_FLOW_PATTERN_LENGTH
for all memcpy operations regardless of the actual flow item type. This
could lead to copying incorrect amounts of data.

This patch adds a switch statement to determine the correct size based
on the actual flow item type (IPv4, IPv6, UDP, TCP) and uses that size
for the memcpy operations on spec, mask, and last fields.

Also adds validation to reject unsupported item types.

Fixes: 59f3a8acbcdb ("app/testpmd: add flex item commands")
Cc: stable@dpdk.org

Signed-off-by: Maayan Kashani <mkashani@nvidia.com>
---
 app/test-pmd/cmd_flex_item.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/app/test-pmd/cmd_flex_item.c b/app/test-pmd/cmd_flex_item.c
index e6e1cefeb3d..af6c087feba 100644
--- a/app/test-pmd/cmd_flex_item.c
+++ b/app/test-pmd/cmd_flex_item.c
@@ -143,21 +143,22 @@ flex_link_item_parse(const char *src, struct rte_flow_item *item)
 	if (ret)
 		return ret;
 	item->type = pattern->type;
-	if (pattern->spec) {
+	ret = rte_flow_conv(RTE_FLOW_CONV_OP_ITEM_MASK, NULL, 0, item, NULL);
+	if ((ret > 0) && pattern->spec) {
 		ptr = (void *)(uintptr_t)item->spec;
-		memcpy(ptr, pattern->spec, FLEX_MAX_FLOW_PATTERN_LENGTH);
+		memcpy(ptr, pattern->spec, ret);
 	} else {
 		item->spec = NULL;
 	}
-	if (pattern->mask) {
+	if ((ret > 0) && pattern->mask) {
 		ptr = (void *)(uintptr_t)item->mask;
-		memcpy(ptr, pattern->mask, FLEX_MAX_FLOW_PATTERN_LENGTH);
+		memcpy(ptr, pattern->mask, ret);
 	} else {
 		item->mask = NULL;
 	}
-	if (pattern->last) {
+	if ((ret > 0) && pattern->last) {
 		ptr = (void *)(uintptr_t)item->last;
-		memcpy(ptr, pattern->last, FLEX_MAX_FLOW_PATTERN_LENGTH);
+		memcpy(ptr, pattern->last, ret);
 	} else {
 		item->last = NULL;
 	}
-- 
2.21.0

Re: [PATCH v2] app/testpmd: fix flex item link parsing

[Stephen Hemminger]

On Sun, 16 Nov 2025 14:14:37 +0200
Maayan Kashani <mkashani@nvidia.com> wrote:

> The flex_link_item_parse function was using FLEX_MAX_FLOW_PATTERN_LENGTH
> for all memcpy operations regardless of the actual flow item type. This
> could lead to copying incorrect amounts of data.
> 
> This patch adds a switch statement to determine the correct size based
> on the actual flow item type (IPv4, IPv6, UDP, TCP) and uses that size
> for the memcpy operations on spec, mask, and last fields.
> 
> Also adds validation to reject unsupported item types.
> 
> Fixes: 59f3a8acbcdb ("app/testpmd: add flex item commands")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Maayan Kashani <mkashani@nvidia.com>

Queued to next-net