[PATCH] net/enic: fix null dereference in flow query count

[PATCH] net/enic: fix null dereference in flow query count

[Alexey Simakov]

begin_fm() can return NULL when the flow manager is not initialized.
enic_fm_flow_query_count() did not check the return value, leading
to a NULL pointer dereference on flowman_cmd() and end_fm().

Add NULL check that returns -ENOTSUP with a descriptive error
message via rte_flow_error_set().

Fixes: ea7768b5bba8 ("net/enic: add flow implementation based on Flow Manager API")
Cc: stable@dpdk.org

Signed-off-by: Alexey Simakov <bigalex934@gmail.com>
---
 drivers/net/enic/enic_fm_flow.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/net/enic/enic_fm_flow.c b/drivers/net/enic/enic_fm_flow.c
index 4b0a513977..28e2a9c1e4 100644
--- a/drivers/net/enic/enic_fm_flow.c
+++ b/drivers/net/enic/enic_fm_flow.c
@@ -2904,6 +2904,13 @@ enic_fm_flow_query_count(struct rte_eth_dev *dev,
 
 	ENICPMD_FUNC_TRACE();
 	fm = begin_fm(pmd_priv(dev));
+
+	if (!fm) {
+		return rte_flow_error_set(error, ENOTSUP,
+			RTE_FLOW_ERROR_TYPE_UNSPECIFIED, NULL,
+			"enic: flowman is not initialized");
+	}
+
 	query = data;
 	fm_flow = flow->fm;
 	if (!fm_flow->counter_valid) {
-- 
2.34.1

RE: [PATCH] net/enic: fix null dereference in flow query count

[Hyong Youb Kim (hyonkim)]

> -----Original Message-----
> From: Alexey Simakov <bigalex934@gmail.com>
> Sent: Tuesday, July 7, 2026 8:45 PM
> To: John Daley (johndale) <johndale@cisco.com>; Hyong Youb Kim (hyonkim)
> <hyonkim@cisco.com>
> Cc: dev@dpdk.org; stable@dpdk.org; Alexey Simakov <bigalex934@gmail.com>
> Subject: [PATCH] net/enic: fix null dereference in flow query count
> 
> begin_fm() can return NULL when the flow manager is not initialized.
> enic_fm_flow_query_count() did not check the return value, leading
> to a NULL pointer dereference on flowman_cmd() and end_fm().
> 
> Add NULL check that returns -ENOTSUP with a descriptive error
> message via rte_flow_error_set().
> 
> Fixes: ea7768b5bba8 ("net/enic: add flow implementation based on Flow
> Manager API")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Alexey Simakov <bigalex934@gmail.com>
> ---
>  drivers/net/enic/enic_fm_flow.c | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/drivers/net/enic/enic_fm_flow.c b/drivers/net/enic/enic_fm_flow.c
> index 4b0a513977..28e2a9c1e4 100644
> --- a/drivers/net/enic/enic_fm_flow.c
> +++ b/drivers/net/enic/enic_fm_flow.c
> @@ -2904,6 +2904,13 @@ enic_fm_flow_query_count(struct rte_eth_dev
> *dev,
> 
>  	ENICPMD_FUNC_TRACE();
>  	fm = begin_fm(pmd_priv(dev));
> +
> +	if (!fm) {
> +		return rte_flow_error_set(error, ENOTSUP,
> +			RTE_FLOW_ERROR_TYPE_UNSPECIFIED, NULL,
> +			"enic: flowman is not initialized");
> +	}
> +

This function (query) does not check the return value of begin_fm(). I
believe that is intentional. Instead, the driver checks it when the
app creates a flow (see enic_fm_flow_create).

fm == NULL in this function likely means a bug in the app
(e.g. passing a wrong pointer), or memory corruption, or ... Perhaps a
debug assertion is more appropriate. Not sure..

Thanks.
-Hyong

>  	query = data;
>  	fm_flow = flow->fm;
>  	if (!fm_flow->counter_valid) {
> --
> 2.34.1