From: Shaiq Wani <shaiq.wani@intel.com>
To: dev@dpdk.org, bruce.richardson@intel.com, aman.deep.singh@intel.com
Subject: [PATCH] net/intel: check raw item spec/mask for null
Date: Wed, 7 Jan 2026 13:29:05 +0530 [thread overview]
Message-ID: <20260107075905.179912-1-shaiq.wani@intel.com> (raw)
adds explicit NULL pointer checks for the RAW flow item’s
spec and mask fields in both the IAVF and ICE PMDs.
This prevents potential null pointer dereferences
and provides clearer error reporting to the user.
Signed-off-by: Shaiq Wani <shaiq.wani@intel.com>
---
drivers/net/intel/iavf/iavf_fdir.c | 9 +++++++++
drivers/net/intel/iavf/iavf_fsub.c | 8 ++++++++
drivers/net/intel/iavf/iavf_hash.c | 11 ++++++++++-
drivers/net/intel/ice/ice_fdir_filter.c | 7 +++++++
drivers/net/intel/ice/ice_hash.c | 10 +++++++++-
5 files changed, 43 insertions(+), 2 deletions(-)
diff --git a/drivers/net/intel/iavf/iavf_fdir.c b/drivers/net/intel/iavf/iavf_fdir.c
index 3213464254..0ef6e0d04a 100644
--- a/drivers/net/intel/iavf/iavf_fdir.c
+++ b/drivers/net/intel/iavf/iavf_fdir.c
@@ -773,6 +773,15 @@ iavf_fdir_parse_pattern(__rte_unused struct iavf_adapter *ad,
raw_spec = item->spec;
raw_mask = item->mask;
+ if (!raw_spec || !raw_mask) {
+ PMD_DRV_LOG(ERR, "NULL RAW spec/mask");
+ rte_flow_error_set(error, EINVAL,
+ RTE_FLOW_ERROR_TYPE_ITEM,
+ item,
+ "NULL RAW spec/mask");
+ return -rte_errno;
+ }
+
if (item_num != 1)
return -rte_errno;
diff --git a/drivers/net/intel/iavf/iavf_fsub.c b/drivers/net/intel/iavf/iavf_fsub.c
index eb5a3feab1..18df9c6500 100644
--- a/drivers/net/intel/iavf/iavf_fsub.c
+++ b/drivers/net/intel/iavf/iavf_fsub.c
@@ -185,6 +185,14 @@ iavf_fsub_parse_pattern(const struct rte_flow_item pattern[],
raw_spec = item->spec;
raw_mask = item->mask;
+ if (!raw_spec || !raw_mask) {
+ PMD_DRV_LOG(ERR, "NULL RAW spec/mask");
+ rte_flow_error_set(error, EINVAL,
+ RTE_FLOW_ERROR_TYPE_ITEM,
+ item, "NULL RAW spec/mask");
+ return -rte_errno;
+ }
+
if (item_num != 1)
return -rte_errno;
diff --git a/drivers/net/intel/iavf/iavf_hash.c b/drivers/net/intel/iavf/iavf_hash.c
index 217f0500ab..b433a89b3b 100644
--- a/drivers/net/intel/iavf/iavf_hash.c
+++ b/drivers/net/intel/iavf/iavf_hash.c
@@ -883,6 +883,7 @@ iavf_hash_parse_pattern(const struct rte_flow_item pattern[], uint64_t *phint,
static int
iavf_hash_parse_raw_pattern(const struct rte_flow_item *item,
+ struct rte_flow_error *error,
struct iavf_rss_meta *meta)
{
const struct rte_flow_item_raw *raw_spec, *raw_mask;
@@ -895,6 +896,14 @@ iavf_hash_parse_raw_pattern(const struct rte_flow_item *item,
raw_spec = item->spec;
raw_mask = item->mask;
+ if (!raw_spec || !raw_mask) {
+ PMD_DRV_LOG(ERR, "NULL RAW spec/mask");
+ rte_flow_error_set(error, EINVAL,
+ RTE_FLOW_ERROR_TYPE_ITEM,
+ item, "NULL RAW spec/mask");
+ return -rte_errno;
+ }
+
spec_len = strlen((char *)(uintptr_t)raw_spec->pattern);
if (strlen((char *)(uintptr_t)raw_mask->pattern) !=
spec_len)
@@ -1545,7 +1554,7 @@ iavf_hash_parse_pattern_action(__rte_unused struct iavf_adapter *ad,
if (phint == IAVF_PHINT_RAW) {
rss_meta_ptr->raw_ena = true;
- ret = iavf_hash_parse_raw_pattern(pattern, rss_meta_ptr);
+ ret = iavf_hash_parse_raw_pattern(pattern, error, rss_meta_ptr);
if (ret) {
rte_flow_error_set(error, EINVAL,
RTE_FLOW_ERROR_TYPE_ITEM, NULL,
diff --git a/drivers/net/intel/ice/ice_fdir_filter.c b/drivers/net/intel/ice/ice_fdir_filter.c
index 9dfe5c02cb..f7730ec6ab 100644
--- a/drivers/net/intel/ice/ice_fdir_filter.c
+++ b/drivers/net/intel/ice/ice_fdir_filter.c
@@ -1853,6 +1853,13 @@ ice_fdir_parse_pattern(__rte_unused struct ice_adapter *ad,
raw_spec = item->spec;
raw_mask = item->mask;
+ if (!raw_spec || !raw_mask) {
+ rte_flow_error_set(error, EINVAL,
+ RTE_FLOW_ERROR_TYPE_ITEM,
+ item, "NULL RAW spec/mask");
+ return -rte_errno;
+ }
+
if (item_num != 1)
break;
diff --git a/drivers/net/intel/ice/ice_hash.c b/drivers/net/intel/ice/ice_hash.c
index aa6a21c055..afdc8f220a 100644
--- a/drivers/net/intel/ice/ice_hash.c
+++ b/drivers/net/intel/ice/ice_hash.c
@@ -641,6 +641,7 @@ ice_hash_parse_pattern(const struct rte_flow_item pattern[], uint64_t *phint,
static int
ice_hash_parse_raw_pattern(struct ice_adapter *ad,
const struct rte_flow_item *item,
+ struct rte_flow_error *error,
struct ice_rss_meta *meta)
{
const struct rte_flow_item_raw *raw_spec, *raw_mask;
@@ -658,6 +659,13 @@ ice_hash_parse_raw_pattern(struct ice_adapter *ad,
raw_spec = item->spec;
raw_mask = item->mask;
+ if (!raw_spec || !raw_mask) {
+ rte_flow_error_set(error, EINVAL,
+ RTE_FLOW_ERROR_TYPE_ITEM,
+ item, "NULL RAW spec/mask");
+ return -rte_errno;
+ }
+
spec_len = strnlen((char *)(uintptr_t)raw_spec->pattern,
raw_spec->length + 1);
if (spec_len != raw_spec->length)
@@ -1185,7 +1193,7 @@ ice_hash_parse_pattern_action(__rte_unused struct ice_adapter *ad,
if (phint == ICE_PHINT_RAW) {
rss_meta_ptr->raw.raw_ena = true;
- ret = ice_hash_parse_raw_pattern(ad, pattern, rss_meta_ptr);
+ ret = ice_hash_parse_raw_pattern(ad, pattern, error, rss_meta_ptr);
if (ret) {
rte_flow_error_set(error, EINVAL,
RTE_FLOW_ERROR_TYPE_ITEM, NULL,
--
2.34.1
next reply other threads:[~2026-01-07 8:00 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-01-07 7:59 Shaiq Wani [this message]
2026-01-09 14:41 ` Bruce Richardson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260107075905.179912-1-shaiq.wani@intel.com \
--to=shaiq.wani@intel.com \
--cc=aman.deep.singh@intel.com \
--cc=bruce.richardson@intel.com \
--cc=dev@dpdk.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).