When a RTE_FLOW_ITEM_TYPE_RAW item is used with a non-zero length,
the spec and mask pattern pointers are dereferenced unconditionally
in a loop, causing a segfault if either is NULL. Additionally, no
check is made that the spec and mask have equal lengths before
iterating, which could result in out-of-bounds access.
Add validation before the loop: reject the item if either pattern
pointer is NULL, or if the spec and mask lengths differ.
Bugzilla ID: 1155
Fixes: 6ced3dd72f5f ("net/i40e: support flexible payload parsing for FDIR")
Cc: [email protected]
Signed-off-by: Ciara Loftus <[email protected]>
---
v2:
* Add an additional check for spec and mask length mismatch
---
drivers/net/intel/i40e/i40e_flow.c | 24 ++++++++++++++++++++++++
1 file changed, 24 insertions(+)
diff --git a/drivers/net/intel/i40e/i40e_flow.c
b/drivers/net/intel/i40e/i40e_flow.c
index 2374b9bbca..4624edc758 100644
--- a/drivers/net/intel/i40e/i40e_flow.c
+++ b/drivers/net/intel/i40e/i40e_flow.c
@@ -2350,6 +2350,30 @@ i40e_flow_parse_fdir_pattern(struct rte_eth_dev *dev,
return -rte_errno;
}
+ if (raw_spec->length != 0) {
+ if (raw_spec->pattern == NULL) {
+ rte_flow_error_set(error, EINVAL,
+
RTE_FLOW_ERROR_TYPE_ITEM,
+ item,
+ "NULL RAW spec
pattern");
+ return -rte_errno;
+ }
+ if (raw_mask->pattern == NULL) {
+ rte_flow_error_set(error, EINVAL,
+
RTE_FLOW_ERROR_TYPE_ITEM,
+ item,
+ "NULL RAW mask
pattern");
+ return -rte_errno;
+ }
+ if (raw_spec->length != raw_mask->length) {
+ rte_flow_error_set(error, EINVAL,
+
RTE_FLOW_ERROR_TYPE_ITEM,
+ item,
+ "RAW spec and mask
length mismatch");
+ return -rte_errno;
+ }
+ }
+
for (i = 0; i < raw_spec->length; i++) {
j = i + next_dst_off;
if (j >= RTE_ETH_FDIR_MAX_FLEXLEN ||
--
2.43.0
