On Mon, Mar 09, 2026 at 03:29:19PM +0000, Ciara Loftus wrote:
> When a RTE_FLOW_ITEM_TYPE_RAW item is used with a non-zero length,
> the spec and mask pattern pointers are dereferenced unconditionally
> in a loop, causing a segfault if either is NULL. Additionally, no
> check is made that the spec and mask have equal lengths before
> iterating, which could result in out-of-bounds access.
>
> Add validation before the loop: reject the item if either pattern
> pointer is NULL, or if the spec and mask lengths differ.
>
> Bugzilla ID: 1155
> Fixes: 6ced3dd72f5f ("net/i40e: support flexible payload parsing for FDIR")
> Cc: [email protected]
>
> Signed-off-by: Ciara Loftus <[email protected]>
Missed carrying-forward Anatoly's ack from v1:
Acked-by: Anatoly Burakov <[email protected]>
> ---
> v2:
> * Add an additional check for spec and mask length mismatch
> ---
> drivers/net/intel/i40e/i40e_flow.c | 24 ++++++++++++++++++++++++
> 1 file changed, 24 insertions(+)
>
> diff --git a/drivers/net/intel/i40e/i40e_flow.c
> b/drivers/net/intel/i40e/i40e_flow.c
> index 2374b9bbca..4624edc758 100644
> --- a/drivers/net/intel/i40e/i40e_flow.c
> +++ b/drivers/net/intel/i40e/i40e_flow.c
> @@ -2350,6 +2350,30 @@ i40e_flow_parse_fdir_pattern(struct rte_eth_dev *dev,
> return -rte_errno;
> }
>
> + if (raw_spec->length != 0) {
> + if (raw_spec->pattern == NULL) {
> + rte_flow_error_set(error, EINVAL,
> +
> RTE_FLOW_ERROR_TYPE_ITEM,
> + item,
> + "NULL RAW spec
> pattern");
> + return -rte_errno;
> + }
> + if (raw_mask->pattern == NULL) {
> + rte_flow_error_set(error, EINVAL,
> +
> RTE_FLOW_ERROR_TYPE_ITEM,
> + item,
> + "NULL RAW mask
> pattern");
> + return -rte_errno;
> + }
> + if (raw_spec->length != raw_mask->length) {
> + rte_flow_error_set(error, EINVAL,
> +
> RTE_FLOW_ERROR_TYPE_ITEM,
> + item,
> + "RAW spec and mask
> length mismatch");
> + return -rte_errno;
> + }
> + }
> +
> for (i = 0; i < raw_spec->length; i++) {
> j = i + next_dst_off;
> if (j >= RTE_ETH_FDIR_MAX_FLEXLEN ||
> --
> 2.43.0
>
