[PATCH] net/ark: validate IPv4 octets in address parser

[PATCH] net/ark: validate IPv4 octets in address parser

[Denis Sergeev]

The IPv4 parsing helper used by pktgen and pktchkr reads each octet
with "%u". This allows values above 255 to be accepted from the
configuration file and encoded into unintended device register values.

Reject parsed octets outside the IPv4 byte range before assembling
the 32-bit address.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 9c7188a68d7b ("net/ark: provide API for hardware modules pktchkr and pktgen")

Signed-off-by: Denis Sergeev <denserg.edu@gmail.com>
---
 drivers/net/ark/ark_pktchkr.c | 2 ++
 drivers/net/ark/ark_pktgen.c  | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/drivers/net/ark/ark_pktchkr.c b/drivers/net/ark/ark_pktchkr.c
index e1f336c73c..76e6f42659 100644
--- a/drivers/net/ark/ark_pktchkr.c
+++ b/drivers/net/ark/ark_pktchkr.c
@@ -379,6 +379,8 @@ parse_ipv4_string(char const *ip_address)
 	if (sscanf(ip_address, "%u.%u.%u.%u",
 		   &ip[0], &ip[1], &ip[2], &ip[3]) != 4)
 		return 0;
+	if (ip[0] > 255 || ip[1] > 255 || ip[2] > 255 || ip[3] > 255)
+		return 0;
 	return ip[3] + ip[2] * 0x100 + ip[1] * 0x10000ul + ip[0] * 0x1000000ul;
 }
 
diff --git a/drivers/net/ark/ark_pktgen.c b/drivers/net/ark/ark_pktgen.c
index 69ff7072b2..0b7246c374 100644
--- a/drivers/net/ark/ark_pktgen.c
+++ b/drivers/net/ark/ark_pktgen.c
@@ -360,6 +360,8 @@ parse_ipv4_string(char const *ip_address)
 	if (sscanf(ip_address, "%u.%u.%u.%u",
 		   &ip[0], &ip[1], &ip[2], &ip[3]) != 4)
 		return 0;
+	if (ip[0] > 255 || ip[1] > 255 || ip[2] > 255 || ip[3] > 255)
+		return 0;
 	return ip[3] + ip[2] * 0x100 + ip[1] * 0x10000ul + ip[0] * 0x1000000ul;
 }
 
-- 
2.50.1

Re: [PATCH] net/ark: validate IPv4 octets in address parser

[Stephen Hemminger]

On Wed,  3 Jun 2026 08:47:38 +0300
Denis Sergeev <denserg.edu@gmail.com> wrote:

> The IPv4 parsing helper used by pktgen and pktchkr reads each octet
> with "%u". This allows values above 255 to be accepted from the
> configuration file and encoded into unintended device register values.
> 
> Reject parsed octets outside the IPv4 byte range before assembling
> the 32-bit address.
> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
> 
> Fixes: 9c7188a68d7b ("net/ark: provide API for hardware modules pktchkr and pktgen")
> 
> Signed-off-by: Denis Sergeev <denserg.edu@gmail.com>
> ---

Have to ask, why a driver is rolling it own IP address parser, that is a bad idea.
But then the whole builtin vendor pktgen in a driver is bad idea.

Claude scan of the driver found lots more issues.
Hate to think what Mythos would find here...

[PATCH v2] net/ark: use standard IPv4 address parser

[Denis Sergeev]

The IPv4 parsing helper used by pktgen and pktchkr read each octet with
"%u", which accepts values above 255 from the configuration file and
encodes them into unintended device register values.

Replace the hand-rolled parser in both modules with inet_pton(), which
validates the dotted-quad format and the octet range, and matches the
IPv4 parsing already used by other DPDK drivers. For valid input the
returned value is byte-order identical to the previous helper, so the
register contents are unchanged.

Fixes: 9c7188a68d7b ("net/ark: provide API for hardware modules pktchkr and pktgen")
Cc: stable@dpdk.org

Signed-off-by: Denis Sergeev <denserg.edu@gmail.com>
---
v2:
 - Replace the hand-rolled parser with inet_pton() in both modules
   instead of adding explicit octet range checks.

 drivers/net/ark/ark_pktchkr.c | 9 +++++----
 drivers/net/ark/ark_pktgen.c  | 9 +++++----
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/drivers/net/ark/ark_pktchkr.c b/drivers/net/ark/ark_pktchkr.c
index e1f336c73c..67405ac18a 100644
--- a/drivers/net/ark/ark_pktchkr.c
+++ b/drivers/net/ark/ark_pktchkr.c
@@ -4,9 +4,11 @@
 
 #include <stdlib.h>
 #include <unistd.h>
+#include <arpa/inet.h>
 
 #include <rte_string_fns.h>
 #include <rte_malloc.h>
+#include <rte_byteorder.h>
 
 #include "ark_pktchkr.h"
 #include "ark_logs.h"
@@ -374,12 +376,11 @@ static int32_t parse_ipv4_string(char const *ip_address);
 static int32_t
 parse_ipv4_string(char const *ip_address)
 {
-	unsigned int ip[4];
+	struct in_addr addr;
 
-	if (sscanf(ip_address, "%u.%u.%u.%u",
-		   &ip[0], &ip[1], &ip[2], &ip[3]) != 4)
+	if (inet_pton(AF_INET, ip_address, &addr) != 1)
 		return 0;
-	return ip[3] + ip[2] * 0x100 + ip[1] * 0x10000ul + ip[0] * 0x1000000ul;
+	return rte_be_to_cpu_32(addr.s_addr);
 }
 
 void
diff --git a/drivers/net/ark/ark_pktgen.c b/drivers/net/ark/ark_pktgen.c
index 69ff7072b2..05d5773d44 100644
--- a/drivers/net/ark/ark_pktgen.c
+++ b/drivers/net/ark/ark_pktgen.c
@@ -4,9 +4,11 @@
 
 #include <stdlib.h>
 #include <unistd.h>
+#include <arpa/inet.h>
 
 #include <rte_string_fns.h>
 #include <rte_malloc.h>
+#include <rte_byteorder.h>
 #include <rte_thread.h>
 
 #include "ark_pktgen.h"
@@ -355,12 +357,11 @@ static int32_t parse_ipv4_string(char const *ip_address);
 static int32_t
 parse_ipv4_string(char const *ip_address)
 {
-	unsigned int ip[4];
+	struct in_addr addr;
 
-	if (sscanf(ip_address, "%u.%u.%u.%u",
-		   &ip[0], &ip[1], &ip[2], &ip[3]) != 4)
+	if (inet_pton(AF_INET, ip_address, &addr) != 1)
 		return 0;
-	return ip[3] + ip[2] * 0x100 + ip[1] * 0x10000ul + ip[0] * 0x1000000ul;
+	return rte_be_to_cpu_32(addr.s_addr);
 }
 
 static void
-- 
2.50.1

Re: [PATCH v2] net/ark: use standard IPv4 address parser

[Stephen Hemminger]

On Thu,  4 Jun 2026 06:48:37 +0300
Denis Sergeev <denserg.edu@gmail.com> wrote:

> The IPv4 parsing helper used by pktgen and pktchkr read each octet with
> "%u", which accepts values above 255 from the configuration file and
> encodes them into unintended device register values.
> 
> Replace the hand-rolled parser in both modules with inet_pton(), which
> validates the dotted-quad format and the octet range, and matches the
> IPv4 parsing already used by other DPDK drivers. For valid input the
> returned value is byte-order identical to the previous helper, so the
> register contents are unchanged.
> 
> Fixes: 9c7188a68d7b ("net/ark: provide API for hardware modules pktchkr and pktgen")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Denis Sergeev <denserg.edu@gmail.com>
> ---

I think you need an additional header.

FAILED: drivers/libtmp_rte_net_ark.a.p/net_ark_ark_pktchkr.c.o
cc -Idrivers/libtmp_rte_net_ark.a.p -Idrivers -I../drivers -Idrivers/net/ark -I../drivers/net/ark -Ilib/ethdev -I../lib/ethdev -Ilib/eal/common -I../lib/eal/common -I. -I.. -Iconfig -I../config -Ilib/eal/include -I../lib/eal/include -Ilib/eal/freebsd/include -I../lib/eal/freebsd/include -Ilib/eal/x86/include -I../lib/eal/x86/include -Ilib/eal -I../lib/eal -Ilib/kvargs -I../lib/kvargs -Ilib/log -I../lib/log -Ilib/metrics -I../lib/metrics -Ilib/telemetry -I../lib/telemetry -Ilib/argparse -I../lib/argparse -Ilib/net -I../lib/net -Ilib/mbuf -I../lib/mbuf -Ilib/mempool -I../lib/mempool -Ilib/ring -I../lib/ring -Ilib/meter -I../lib/meter -Idrivers/bus/pci -I../drivers/bus/pci -I../drivers/bus/pci/bsd -Ilib/pci -I../lib/pci -Idrivers/bus/vdev -I../drivers/bus/vdev -Xclang -fcolor-diagnostics -pipe -D_FILE_OFFSET_BITS=64 -Wall -Winvalid-pch -Wextra -Werror -std=c11 -O3 -include rte_config.h -Wvla -Wcast-qual -Wcomma -Wdeprecated -Wformat -Wformat-nonliteral -Wformat-security -Wmissing-declar
 ations -Wmissing-prototypes -Wnested-externs -Wold-style-definition -Wpointer-arith -Wshadow -Wsign-compare -Wstrict-prototypes -Wundef -Wwrite-strings -Wno-missing-field-initializers -D_GNU_SOURCE -D__BSD_VISIBLE -fPIC -march=native -mrtm -DALLOW_EXPERIMENTAL_API -DALLOW_INTERNAL_API -Wno-format-truncation -Wno-address-of-packed-member -DRTE_LOG_DEFAULT_LOGTYPE=pmd.net.ark -DRTE_ANNOTATE_LOCKS -Wthread-safety -MD -MQ drivers/libtmp_rte_net_ark.a.p/net_ark_ark_pktchkr.c.o -MF drivers/libtmp_rte_net_ark.a.p/net_ark_ark_pktchkr.c.o.d -o drivers/libtmp_rte_net_ark.a.p/net_ark_ark_pktchkr.c.o -c ../drivers/net/ark/ark_pktchkr.c
../drivers/net/ark/ark_pktchkr.c:381:16: error: use of undeclared identifier 'AF_INET'
381 |         if (inet_pton(AF_INET, ip_address, &addr) != 1)