On Wed, 27 May 2026 02:11:58 +0800
James Raphael Tiovalen <[email protected]> wrote:
> rte_flow_conv_item_spec() is documented to truncate output to the
> caller-supplied buffer size. For RTE_FLOW_ITEM_TYPE_GENEVE_OPT, the
> deep-copy of the variable-length option data was gated on `size > 0`
> instead of `size >= off + tmp`, the form used by the sibling RAW
> branch. A caller passing a buffer just large enough for the header
> struct had adjacent memory clobbered by up to `option_len * 4` bytes of
> option payload.
>
> Align the GENEVE_OPT guard with the RAW one.
>
> Fixes: 841a0445442d ("ethdev: fix GENEVE option item conversion")
> Cc: [email protected]
>
> Signed-off-by: James Raphael Tiovalen <[email protected]>
> ---
Does not apply to current main branch.
There were recent fixes in this area.
Rebase and resubmit please.
