* [PATCH] net/i40e: fix null dereference in raw flow item
@ 2026-03-09 13:28 Ciara Loftus
2026-03-09 14:45 ` Burakov, Anatoly
2026-03-09 15:29 ` [PATCH v2] net/i40e: validate raw flow items before dereferencing Ciara Loftus
0 siblings, 2 replies; 5+ messages in thread
From: Ciara Loftus @ 2026-03-09 13:28 UTC (permalink / raw)
To: dev; +Cc: Ciara Loftus, stable
When a RTE_FLOW_ITEM_TYPE_RAW item is used with a non-zero length
and a NULL pattern pointer in either the spec or mask, a segfault
occurs as the pattern bytes are accessed unconditionally in a loop.
Add NULL checks for both spec->pattern and mask->pattern before entering
the loop that uses those fields.
Bugzilla ID: 1155
Fixes: 6ced3dd72f5f ("net/i40e: support flexible payload parsing for FDIR")
Cc: stable@dpdk.org
Signed-off-by: Ciara Loftus <ciara.loftus@intel.com>
---
drivers/net/intel/i40e/i40e_flow.c | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
diff --git a/drivers/net/intel/i40e/i40e_flow.c b/drivers/net/intel/i40e/i40e_flow.c
index 2374b9bbca..6ad3013573 100644
--- a/drivers/net/intel/i40e/i40e_flow.c
+++ b/drivers/net/intel/i40e/i40e_flow.c
@@ -2350,6 +2350,24 @@ i40e_flow_parse_fdir_pattern(struct rte_eth_dev *dev,
return -rte_errno;
}
+ if (raw_spec->length != 0) {
+ if (raw_spec->pattern == NULL) {
+ rte_flow_error_set(error, EINVAL,
+ RTE_FLOW_ERROR_TYPE_ITEM,
+ item,
+ "NULL RAW spec pattern");
+ return -rte_errno;
+ }
+
+ if (raw_mask->pattern == NULL) {
+ rte_flow_error_set(error, EINVAL,
+ RTE_FLOW_ERROR_TYPE_ITEM,
+ item,
+ "NULL RAW mask pattern");
+ return -rte_errno;
+ }
+ }
+
for (i = 0; i < raw_spec->length; i++) {
j = i + next_dst_off;
if (j >= RTE_ETH_FDIR_MAX_FLEXLEN ||
--
2.43.0
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH] net/i40e: fix null dereference in raw flow item
2026-03-09 13:28 [PATCH] net/i40e: fix null dereference in raw flow item Ciara Loftus
@ 2026-03-09 14:45 ` Burakov, Anatoly
2026-03-09 15:29 ` [PATCH v2] net/i40e: validate raw flow items before dereferencing Ciara Loftus
1 sibling, 0 replies; 5+ messages in thread
From: Burakov, Anatoly @ 2026-03-09 14:45 UTC (permalink / raw)
To: Ciara Loftus, dev; +Cc: stable
On 3/9/2026 2:28 PM, Ciara Loftus wrote:
> When a RTE_FLOW_ITEM_TYPE_RAW item is used with a non-zero length
> and a NULL pattern pointer in either the spec or mask, a segfault
> occurs as the pattern bytes are accessed unconditionally in a loop.
> Add NULL checks for both spec->pattern and mask->pattern before entering
> the loop that uses those fields.
>
> Bugzilla ID: 1155
> Fixes: 6ced3dd72f5f ("net/i40e: support flexible payload parsing for FDIR")
> Cc: stable@dpdk.org
>
> Signed-off-by: Ciara Loftus <ciara.loftus@intel.com>
> ---
> drivers/net/intel/i40e/i40e_flow.c | 18 ++++++++++++++++++
> 1 file changed, 18 insertions(+)
>
> diff --git a/drivers/net/intel/i40e/i40e_flow.c b/drivers/net/intel/i40e/i40e_flow.c
> index 2374b9bbca..6ad3013573 100644
> --- a/drivers/net/intel/i40e/i40e_flow.c
> +++ b/drivers/net/intel/i40e/i40e_flow.c
> @@ -2350,6 +2350,24 @@ i40e_flow_parse_fdir_pattern(struct rte_eth_dev *dev,
> return -rte_errno;
> }
>
> + if (raw_spec->length != 0) {
> + if (raw_spec->pattern == NULL) {
> + rte_flow_error_set(error, EINVAL,
> + RTE_FLOW_ERROR_TYPE_ITEM,
> + item,
> + "NULL RAW spec pattern");
> + return -rte_errno;
> + }
> +
> + if (raw_mask->pattern == NULL) {
> + rte_flow_error_set(error, EINVAL,
> + RTE_FLOW_ERROR_TYPE_ITEM,
> + item,
> + "NULL RAW mask pattern");
> + return -rte_errno;
> + }
> + }
> +
> for (i = 0; i < raw_spec->length; i++) {
> j = i + next_dst_off;
> if (j >= RTE_ETH_FDIR_MAX_FLEXLEN ||
Maybe also check if raw_mask length matches raw_spec?
Otherwise,
Acked-by: Anatoly Burakov <anatoly.burakov@intel.com>
--
Thanks,
Anatoly
^ permalink raw reply [flat|nested] 5+ messages in thread* [PATCH v2] net/i40e: validate raw flow items before dereferencing
2026-03-09 13:28 [PATCH] net/i40e: fix null dereference in raw flow item Ciara Loftus
2026-03-09 14:45 ` Burakov, Anatoly
@ 2026-03-09 15:29 ` Ciara Loftus
2026-03-11 15:21 ` Bruce Richardson
1 sibling, 1 reply; 5+ messages in thread
From: Ciara Loftus @ 2026-03-09 15:29 UTC (permalink / raw)
To: dev; +Cc: Ciara Loftus, stable
When a RTE_FLOW_ITEM_TYPE_RAW item is used with a non-zero length,
the spec and mask pattern pointers are dereferenced unconditionally
in a loop, causing a segfault if either is NULL. Additionally, no
check is made that the spec and mask have equal lengths before
iterating, which could result in out-of-bounds access.
Add validation before the loop: reject the item if either pattern
pointer is NULL, or if the spec and mask lengths differ.
Bugzilla ID: 1155
Fixes: 6ced3dd72f5f ("net/i40e: support flexible payload parsing for FDIR")
Cc: stable@dpdk.org
Signed-off-by: Ciara Loftus <ciara.loftus@intel.com>
---
v2:
* Add an additional check for spec and mask length mismatch
---
drivers/net/intel/i40e/i40e_flow.c | 24 ++++++++++++++++++++++++
1 file changed, 24 insertions(+)
diff --git a/drivers/net/intel/i40e/i40e_flow.c b/drivers/net/intel/i40e/i40e_flow.c
index 2374b9bbca..4624edc758 100644
--- a/drivers/net/intel/i40e/i40e_flow.c
+++ b/drivers/net/intel/i40e/i40e_flow.c
@@ -2350,6 +2350,30 @@ i40e_flow_parse_fdir_pattern(struct rte_eth_dev *dev,
return -rte_errno;
}
+ if (raw_spec->length != 0) {
+ if (raw_spec->pattern == NULL) {
+ rte_flow_error_set(error, EINVAL,
+ RTE_FLOW_ERROR_TYPE_ITEM,
+ item,
+ "NULL RAW spec pattern");
+ return -rte_errno;
+ }
+ if (raw_mask->pattern == NULL) {
+ rte_flow_error_set(error, EINVAL,
+ RTE_FLOW_ERROR_TYPE_ITEM,
+ item,
+ "NULL RAW mask pattern");
+ return -rte_errno;
+ }
+ if (raw_spec->length != raw_mask->length) {
+ rte_flow_error_set(error, EINVAL,
+ RTE_FLOW_ERROR_TYPE_ITEM,
+ item,
+ "RAW spec and mask length mismatch");
+ return -rte_errno;
+ }
+ }
+
for (i = 0; i < raw_spec->length; i++) {
j = i + next_dst_off;
if (j >= RTE_ETH_FDIR_MAX_FLEXLEN ||
--
2.43.0
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH v2] net/i40e: validate raw flow items before dereferencing
2026-03-09 15:29 ` [PATCH v2] net/i40e: validate raw flow items before dereferencing Ciara Loftus
@ 2026-03-11 15:21 ` Bruce Richardson
2026-03-11 17:24 ` Bruce Richardson
0 siblings, 1 reply; 5+ messages in thread
From: Bruce Richardson @ 2026-03-11 15:21 UTC (permalink / raw)
To: Ciara Loftus; +Cc: dev, stable
On Mon, Mar 09, 2026 at 03:29:19PM +0000, Ciara Loftus wrote:
> When a RTE_FLOW_ITEM_TYPE_RAW item is used with a non-zero length,
> the spec and mask pattern pointers are dereferenced unconditionally
> in a loop, causing a segfault if either is NULL. Additionally, no
> check is made that the spec and mask have equal lengths before
> iterating, which could result in out-of-bounds access.
>
> Add validation before the loop: reject the item if either pattern
> pointer is NULL, or if the spec and mask lengths differ.
>
> Bugzilla ID: 1155
> Fixes: 6ced3dd72f5f ("net/i40e: support flexible payload parsing for FDIR")
> Cc: stable@dpdk.org
>
> Signed-off-by: Ciara Loftus <ciara.loftus@intel.com>
Missed carrying-forward Anatoly's ack from v1:
Acked-by: Anatoly Burakov <anatoly.burakov@intel.com>
> ---
> v2:
> * Add an additional check for spec and mask length mismatch
> ---
> drivers/net/intel/i40e/i40e_flow.c | 24 ++++++++++++++++++++++++
> 1 file changed, 24 insertions(+)
>
> diff --git a/drivers/net/intel/i40e/i40e_flow.c b/drivers/net/intel/i40e/i40e_flow.c
> index 2374b9bbca..4624edc758 100644
> --- a/drivers/net/intel/i40e/i40e_flow.c
> +++ b/drivers/net/intel/i40e/i40e_flow.c
> @@ -2350,6 +2350,30 @@ i40e_flow_parse_fdir_pattern(struct rte_eth_dev *dev,
> return -rte_errno;
> }
>
> + if (raw_spec->length != 0) {
> + if (raw_spec->pattern == NULL) {
> + rte_flow_error_set(error, EINVAL,
> + RTE_FLOW_ERROR_TYPE_ITEM,
> + item,
> + "NULL RAW spec pattern");
> + return -rte_errno;
> + }
> + if (raw_mask->pattern == NULL) {
> + rte_flow_error_set(error, EINVAL,
> + RTE_FLOW_ERROR_TYPE_ITEM,
> + item,
> + "NULL RAW mask pattern");
> + return -rte_errno;
> + }
> + if (raw_spec->length != raw_mask->length) {
> + rte_flow_error_set(error, EINVAL,
> + RTE_FLOW_ERROR_TYPE_ITEM,
> + item,
> + "RAW spec and mask length mismatch");
> + return -rte_errno;
> + }
> + }
> +
> for (i = 0; i < raw_spec->length; i++) {
> j = i + next_dst_off;
> if (j >= RTE_ETH_FDIR_MAX_FLEXLEN ||
> --
> 2.43.0
>
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH v2] net/i40e: validate raw flow items before dereferencing
2026-03-11 15:21 ` Bruce Richardson
@ 2026-03-11 17:24 ` Bruce Richardson
0 siblings, 0 replies; 5+ messages in thread
From: Bruce Richardson @ 2026-03-11 17:24 UTC (permalink / raw)
To: Ciara Loftus; +Cc: dev, stable
On Wed, Mar 11, 2026 at 03:21:35PM +0000, Bruce Richardson wrote:
> On Mon, Mar 09, 2026 at 03:29:19PM +0000, Ciara Loftus wrote:
> > When a RTE_FLOW_ITEM_TYPE_RAW item is used with a non-zero length,
> > the spec and mask pattern pointers are dereferenced unconditionally
> > in a loop, causing a segfault if either is NULL. Additionally, no
> > check is made that the spec and mask have equal lengths before
> > iterating, which could result in out-of-bounds access.
> >
> > Add validation before the loop: reject the item if either pattern
> > pointer is NULL, or if the spec and mask lengths differ.
> >
> > Bugzilla ID: 1155
> > Fixes: 6ced3dd72f5f ("net/i40e: support flexible payload parsing for FDIR")
> > Cc: stable@dpdk.org
> >
> > Signed-off-by: Ciara Loftus <ciara.loftus@intel.com>
>
> Missed carrying-forward Anatoly's ack from v1:
> Acked-by: Anatoly Burakov <anatoly.burakov@intel.com>
Applied to dpdk-next-net-intel.
Thanks,
/Bruce
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-03-11 17:24 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-03-09 13:28 [PATCH] net/i40e: fix null dereference in raw flow item Ciara Loftus
2026-03-09 14:45 ` Burakov, Anatoly
2026-03-09 15:29 ` [PATCH v2] net/i40e: validate raw flow items before dereferencing Ciara Loftus
2026-03-11 15:21 ` Bruce Richardson
2026-03-11 17:24 ` Bruce Richardson
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox