[PATCH v1 1/4] net/ice: fix potential NULL dereference

[PATCH v1 1/4] net/ice: fix potential NULL dereference

[Anatoly Burakov]

Static analysis reports that a rule might have a valid engine but invalid
rule pointer while having a valid rule size. This should not happen in
normal operation, but it's a good defensive check, so fix the potential
issue by checking for the problematic condition before dumping flow memory.

Coverity issue: 503774

Fixes: 215a768c180a ("net/ice: support flow dump")

Signed-off-by: Anatoly Burakov <anatoly.burakov@intel.com>
---
 drivers/net/intel/ice/ice_generic_flow.c | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/drivers/net/intel/ice/ice_generic_flow.c b/drivers/net/intel/ice/ice_generic_flow.c
index cbc3d78079..04097cca76 100644
--- a/drivers/net/intel/ice/ice_generic_flow.c
+++ b/drivers/net/intel/ice/ice_generic_flow.c
@@ -2660,15 +2660,18 @@ ice_flow_dev_dump(struct rte_eth_dev *dev,
 		if (flow != NULL && p_flow != flow)
 			continue;
 
+		/* this should not happen */
+		if (p_flow->engine == NULL || p_flow->rule == NULL) {
+			PMD_DRV_LOG(DEBUG, "Invalid flow");
+			continue;
+		}
+
 		found = true;
-		if (p_flow->engine != NULL) {
-			rule_size = p_flow->engine->rule_size;
-			if (p_flow->rule != NULL)
-				rule_data = p_flow->rule;
-		}
 
-		if (p_flow->engine != NULL)
-			ice_flow_dump_blob(file,
+		rule_size = p_flow->engine->rule_size;
+		rule_data = p_flow->rule;
+
+		ice_flow_dump_blob(file,
 				p_flow->engine->name != NULL ?
 				p_flow->engine->name : "unknown",
 				rule_data, rule_size);
-- 
2.47.3

[PATCH v1 2/4] net/ixgbe: fix potential NULL dereference

[Anatoly Burakov]

Static analysis reports that a rule dump may trigger NULL dereference. This
cannot actually happen because dump_blob will not dereference the rule_data
when rule_size is 0, but it's a good defensive check anyway, so add it.

Coverity issue: 503773

Fixes: 51f505a4090f ("net/ixgbe: support flow dump")

Signed-off-by: Anatoly Burakov <anatoly.burakov@intel.com>
---
 drivers/net/intel/ixgbe/ixgbe_flow.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/drivers/net/intel/ixgbe/ixgbe_flow.c b/drivers/net/intel/ixgbe/ixgbe_flow.c
index 19d7f93d93..6868893d46 100644
--- a/drivers/net/intel/ixgbe/ixgbe_flow.c
+++ b/drivers/net/intel/ixgbe/ixgbe_flow.c
@@ -3345,11 +3345,18 @@ ixgbe_flow_dev_dump(struct rte_eth_dev *dev,
 		if (flow != NULL && p_flow != flow)
 			continue;
 
+		/* this should not happen */
+		if (p_flow->rule == NULL) {
+			PMD_DRV_LOG(DEBUG, "Invalid flow");
+			continue;
+		}
+
+		rule_size = ixgbe_flow_rule_size(p_flow);
+		if (rule_size == 0)
+			continue;
+
 		found = true;
-		if (p_flow->rule != NULL) {
-			rule_data = ixgbe_flow_rule_data(p_flow);
-			rule_size = ixgbe_flow_rule_size(p_flow);
-		}
+		rule_data = ixgbe_flow_rule_data(p_flow);
 		engine_name = ixgbe_flow_rule_engine_name(p_flow);
 		ixgbe_flow_dump_blob(file, engine_name,
 			rule_data, rule_size);
-- 
2.47.3

[PATCH v1 3/4] net/i40e: fix potential NULL dereference

[Anatoly Burakov]

Static analysis reports that a rule dump may trigger NULL dereference when
rule pointer is NULL. This should not happen under normal circumstances as
0 sized rule would not dereference the rule data pointer due to chunking,
but it's a good defensive check, so add it.

Coverity issue: 503771

Fixes: ffaddd0fa935 ("net/i40e: support flow dump")

Signed-off-by: Anatoly Burakov <anatoly.burakov@intel.com>
---
 drivers/net/intel/i40e/i40e_flow.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/drivers/net/intel/i40e/i40e_flow.c b/drivers/net/intel/i40e/i40e_flow.c
index 1051c99fba..142cfb5150 100644
--- a/drivers/net/intel/i40e/i40e_flow.c
+++ b/drivers/net/intel/i40e/i40e_flow.c
@@ -1276,11 +1276,19 @@ i40e_flow_dev_dump(struct rte_eth_dev *dev,
 		if (flow != NULL && p_flow != flow)
 			continue;
 
+		/* should not happen */
+		if (p_flow->rule == NULL) {
+			PMD_DRV_LOG(DEBUG, "Invalid flow rule");
+			continue;
+		}
+
+		rule_size = i40e_flow_rule_size(p_flow->filter_type);
+		/* should not happen either */
+		if (rule_size == 0)
+			continue;
+
 		found = true;
-		if (p_flow->rule != NULL) {
-			rule_size = i40e_flow_rule_size(p_flow->filter_type);
-			rule_data = p_flow->rule;
-		}
+		rule_data = p_flow->rule;
 		i40e_flow_dump_blob(file,
 			i40e_flow_rule_name(p_flow->filter_type),
 			rule_data, rule_size);
-- 
2.47.3

[PATCH v1 4/4] net/iavf: fix potential NULL dereference

[Anatoly Burakov]

Static analysis reports that a rule might have a valid engine but invalid
rule pointer while having a valid rule size. This should not happen in
normal operation, but it's a good defensive check, so fix the potential
issue by checking for the problematic condition before dumping flow memory.

Coverity issue: 503764

Fixes: 32251f047e92 ("net/iavf: support flow dump")

Signed-off-by: Anatoly Burakov <anatoly.burakov@intel.com>
---
 drivers/net/intel/iavf/iavf_generic_flow.c | 23 ++++++++++++----------
 1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/drivers/net/intel/iavf/iavf_generic_flow.c b/drivers/net/intel/iavf/iavf_generic_flow.c
index 8bd874c32a..84bb161bd1 100644
--- a/drivers/net/intel/iavf/iavf_generic_flow.c
+++ b/drivers/net/intel/iavf/iavf_generic_flow.c
@@ -2414,18 +2414,21 @@ iavf_flow_dev_dump(struct rte_eth_dev *dev,
 		if (flow != NULL && f != flow)
 			continue;
 
+		/* this should not happen */
+		if (f->engine == NULL || f->rule == NULL) {
+			PMD_DRV_LOG(DEBUG, "Invalid flow");
+			continue;
+		}
+
 		found = true;
-		if (f->engine != NULL) {
-			rule_size = f->engine->rule_size;
-			if (f->rule != NULL)
-				rule_data = f->rule;
-		}
 
-		if (f->engine != NULL)
-			iavf_flow_dump_blob(file,
-				f->engine->name != NULL ?
-					f->engine->name : "unknown",
-				rule_data, rule_size);
+		rule_size = f->engine->rule_size;
+		rule_data = f->rule;
+
+		iavf_flow_dump_blob(file,
+			f->engine->name != NULL ?
+				f->engine->name : "unknown",
+			rule_data, rule_size);
 	}
 	rte_spinlock_unlock(&vf->flow_ops_lock);
 
-- 
2.47.3

Re: [PATCH v1 1/4] net/ice: fix potential NULL dereference

[Bruce Richardson]

On Thu, Jun 25, 2026 at 04:48:10PM +0100, Anatoly Burakov wrote:
> Static analysis reports that a rule might have a valid engine but invalid
> rule pointer while having a valid rule size. This should not happen in
> normal operation, but it's a good defensive check, so fix the potential
> issue by checking for the problematic condition before dumping flow memory.
> 
> Coverity issue: 503774
> 
> Fixes: 215a768c180a ("net/ice: support flow dump")
> 
> Signed-off-by: Anatoly Burakov <anatoly.burakov@intel.com>
> ---
Acked-by: Bruce Richardson <bruce.richardson@intel.com>

Re: [PATCH v1 2/4] net/ixgbe: fix potential NULL dereference

[Bruce Richardson]

On Thu, Jun 25, 2026 at 04:48:11PM +0100, Anatoly Burakov wrote:
> Static analysis reports that a rule dump may trigger NULL dereference. This
> cannot actually happen because dump_blob will not dereference the rule_data
> when rule_size is 0, but it's a good defensive check anyway, so add it.
> 
> Coverity issue: 503773
> 
> Fixes: 51f505a4090f ("net/ixgbe: support flow dump")
> 
> Signed-off-by: Anatoly Burakov <anatoly.burakov@intel.com>
> ---
Acked-by: Bruce Richardson <bruce.richardson@intel.com>

Re: [PATCH v1 3/4] net/i40e: fix potential NULL dereference

[Bruce Richardson]

On Thu, Jun 25, 2026 at 04:48:12PM +0100, Anatoly Burakov wrote:
> Static analysis reports that a rule dump may trigger NULL dereference when
> rule pointer is NULL. This should not happen under normal circumstances as
> 0 sized rule would not dereference the rule data pointer due to chunking,
> but it's a good defensive check, so add it.
> 
> Coverity issue: 503771
> 
> Fixes: ffaddd0fa935 ("net/i40e: support flow dump")
> 
> Signed-off-by: Anatoly Burakov <anatoly.burakov@intel.com>
> ---
Acked-by: Bruce Richardson <bruce.richardson@intel.com>

Re: [PATCH v1 4/4] net/iavf: fix potential NULL dereference

[Bruce Richardson]

On Thu, Jun 25, 2026 at 04:48:13PM +0100, Anatoly Burakov wrote:
> Static analysis reports that a rule might have a valid engine but invalid
> rule pointer while having a valid rule size. This should not happen in
> normal operation, but it's a good defensive check, so fix the potential
> issue by checking for the problematic condition before dumping flow memory.
> 
> Coverity issue: 503764
> 
> Fixes: 32251f047e92 ("net/iavf: support flow dump")
> 
> Signed-off-by: Anatoly Burakov <anatoly.burakov@intel.com>
> ---
Acked-by: Bruce Richardson <bruce.richardson@intel.com>

Re: [PATCH v1 1/4] net/ice: fix potential NULL dereference

[Bruce Richardson]

On Fri, Jun 26, 2026 at 09:47:43AM +0100, Bruce Richardson wrote:
> On Thu, Jun 25, 2026 at 04:48:10PM +0100, Anatoly Burakov wrote:
> > Static analysis reports that a rule might have a valid engine but invalid
> > rule pointer while having a valid rule size. This should not happen in
> > normal operation, but it's a good defensive check, so fix the potential
> > issue by checking for the problematic condition before dumping flow memory.
> > 
> > Coverity issue: 503774
> > 
> > Fixes: 215a768c180a ("net/ice: support flow dump")
> > 
> > Signed-off-by: Anatoly Burakov <anatoly.burakov@intel.com>
> > ---
> Acked-by: Bruce Richardson <bruce.richardson@intel.com>

Series applied to dpdk-next-net-intel.

Thanks,
/Bruce