> -----Original Message-----
> From: Alexey Simakov <[email protected]>
> Sent: Tuesday, July 7, 2026 8:45 PM
> To: John Daley (johndale) <[email protected]>; Hyong Youb Kim (hyonkim)
> <[email protected]>
> Cc: [email protected]; [email protected]; Alexey Simakov <[email protected]>
> Subject: [PATCH] net/enic: fix null dereference in flow query count
>
> begin_fm() can return NULL when the flow manager is not initialized.
> enic_fm_flow_query_count() did not check the return value, leading
> to a NULL pointer dereference on flowman_cmd() and end_fm().
>
> Add NULL check that returns -ENOTSUP with a descriptive error
> message via rte_flow_error_set().
>
> Fixes: ea7768b5bba8 ("net/enic: add flow implementation based on Flow
> Manager API")
> Cc: [email protected]
>
> Signed-off-by: Alexey Simakov <[email protected]>
> ---
> drivers/net/enic/enic_fm_flow.c | 7 +++++++
> 1 file changed, 7 insertions(+)
>
> diff --git a/drivers/net/enic/enic_fm_flow.c b/drivers/net/enic/enic_fm_flow.c
> index 4b0a513977..28e2a9c1e4 100644
> --- a/drivers/net/enic/enic_fm_flow.c
> +++ b/drivers/net/enic/enic_fm_flow.c
> @@ -2904,6 +2904,13 @@ enic_fm_flow_query_count(struct rte_eth_dev
> *dev,
>
> ENICPMD_FUNC_TRACE();
> fm = begin_fm(pmd_priv(dev));
> +
> + if (!fm) {
> + return rte_flow_error_set(error, ENOTSUP,
> + RTE_FLOW_ERROR_TYPE_UNSPECIFIED, NULL,
> + "enic: flowman is not initialized");
> + }
> +
This function (query) does not check the return value of begin_fm(). I
believe that is intentional. Instead, the driver checks it when the
app creates a flow (see enic_fm_flow_create).
fm == NULL in this function likely means a bug in the app
(e.g. passing a wrong pointer), or memory corruption, or ... Perhaps a
debug assertion is more appropriate. Not sure..
Thanks.
-Hyong
> query = data;
> fm_flow = flow->fm;
> if (!fm_flow->counter_valid) {
> --
> 2.34.1
