[PATCH] net/intel: check raw item spec/mask for null

[PATCH] net/intel: check raw item spec/mask for null

[Shaiq Wani]

adds explicit NULL pointer checks for the RAW flow item’s
spec and mask fields in both the IAVF and ICE PMDs.
This prevents potential null pointer dereferences
and provides clearer error reporting to the user.

Signed-off-by: Shaiq Wani <shaiq.wani@intel.com>
---
 drivers/net/intel/iavf/iavf_fdir.c      |  9 +++++++++
 drivers/net/intel/iavf/iavf_fsub.c      |  8 ++++++++
 drivers/net/intel/iavf/iavf_hash.c      | 11 ++++++++++-
 drivers/net/intel/ice/ice_fdir_filter.c |  7 +++++++
 drivers/net/intel/ice/ice_hash.c        | 10 +++++++++-
 5 files changed, 43 insertions(+), 2 deletions(-)

diff --git a/drivers/net/intel/iavf/iavf_fdir.c b/drivers/net/intel/iavf/iavf_fdir.c
index 3213464254..0ef6e0d04a 100644
--- a/drivers/net/intel/iavf/iavf_fdir.c
+++ b/drivers/net/intel/iavf/iavf_fdir.c
@@ -773,6 +773,15 @@ iavf_fdir_parse_pattern(__rte_unused struct iavf_adapter *ad,
 			raw_spec = item->spec;
 			raw_mask = item->mask;
 
+			if (!raw_spec || !raw_mask) {
+				PMD_DRV_LOG(ERR, "NULL RAW spec/mask");
+				rte_flow_error_set(error, EINVAL,
+						RTE_FLOW_ERROR_TYPE_ITEM,
+						item,
+						"NULL RAW spec/mask");
+				return -rte_errno;
+			}
+
 			if (item_num != 1)
 				return -rte_errno;
 
diff --git a/drivers/net/intel/iavf/iavf_fsub.c b/drivers/net/intel/iavf/iavf_fsub.c
index eb5a3feab1..18df9c6500 100644
--- a/drivers/net/intel/iavf/iavf_fsub.c
+++ b/drivers/net/intel/iavf/iavf_fsub.c
@@ -185,6 +185,14 @@ iavf_fsub_parse_pattern(const struct rte_flow_item pattern[],
 			raw_spec = item->spec;
 			raw_mask = item->mask;
 
+			if (!raw_spec || !raw_mask) {
+				PMD_DRV_LOG(ERR, "NULL RAW spec/mask");
+				rte_flow_error_set(error, EINVAL,
+						RTE_FLOW_ERROR_TYPE_ITEM,
+						item, "NULL RAW spec/mask");
+				return -rte_errno;
+			}
+
 			if (item_num != 1)
 				return -rte_errno;
 
diff --git a/drivers/net/intel/iavf/iavf_hash.c b/drivers/net/intel/iavf/iavf_hash.c
index 217f0500ab..b433a89b3b 100644
--- a/drivers/net/intel/iavf/iavf_hash.c
+++ b/drivers/net/intel/iavf/iavf_hash.c
@@ -883,6 +883,7 @@ iavf_hash_parse_pattern(const struct rte_flow_item pattern[], uint64_t *phint,
 
 static int
 iavf_hash_parse_raw_pattern(const struct rte_flow_item *item,
+			struct rte_flow_error *error,
 			struct iavf_rss_meta *meta)
 {
 	const struct rte_flow_item_raw *raw_spec, *raw_mask;
@@ -895,6 +896,14 @@ iavf_hash_parse_raw_pattern(const struct rte_flow_item *item,
 	raw_spec = item->spec;
 	raw_mask = item->mask;
 
+	if (!raw_spec || !raw_mask) {
+		PMD_DRV_LOG(ERR, "NULL RAW spec/mask");
+		rte_flow_error_set(error, EINVAL,
+				RTE_FLOW_ERROR_TYPE_ITEM,
+				item, "NULL RAW spec/mask");
+		return -rte_errno;
+	}
+
 	spec_len = strlen((char *)(uintptr_t)raw_spec->pattern);
 	if (strlen((char *)(uintptr_t)raw_mask->pattern) !=
 		spec_len)
@@ -1545,7 +1554,7 @@ iavf_hash_parse_pattern_action(__rte_unused struct iavf_adapter *ad,
 
 	if (phint == IAVF_PHINT_RAW) {
 		rss_meta_ptr->raw_ena = true;
-		ret = iavf_hash_parse_raw_pattern(pattern, rss_meta_ptr);
+		ret = iavf_hash_parse_raw_pattern(pattern, error, rss_meta_ptr);
 		if (ret) {
 			rte_flow_error_set(error, EINVAL,
 					   RTE_FLOW_ERROR_TYPE_ITEM, NULL,
diff --git a/drivers/net/intel/ice/ice_fdir_filter.c b/drivers/net/intel/ice/ice_fdir_filter.c
index 9dfe5c02cb..f7730ec6ab 100644
--- a/drivers/net/intel/ice/ice_fdir_filter.c
+++ b/drivers/net/intel/ice/ice_fdir_filter.c
@@ -1853,6 +1853,13 @@ ice_fdir_parse_pattern(__rte_unused struct ice_adapter *ad,
 			raw_spec = item->spec;
 			raw_mask = item->mask;
 
+			if (!raw_spec || !raw_mask) {
+				rte_flow_error_set(error, EINVAL,
+						RTE_FLOW_ERROR_TYPE_ITEM,
+						item, "NULL RAW spec/mask");
+				return -rte_errno;
+			}
+
 			if (item_num != 1)
 				break;
 
diff --git a/drivers/net/intel/ice/ice_hash.c b/drivers/net/intel/ice/ice_hash.c
index aa6a21c055..afdc8f220a 100644
--- a/drivers/net/intel/ice/ice_hash.c
+++ b/drivers/net/intel/ice/ice_hash.c
@@ -641,6 +641,7 @@ ice_hash_parse_pattern(const struct rte_flow_item pattern[], uint64_t *phint,
 static int
 ice_hash_parse_raw_pattern(struct ice_adapter *ad,
 				const struct rte_flow_item *item,
+				struct rte_flow_error *error,
 				struct ice_rss_meta *meta)
 {
 	const struct rte_flow_item_raw *raw_spec, *raw_mask;
@@ -658,6 +659,13 @@ ice_hash_parse_raw_pattern(struct ice_adapter *ad,
 	raw_spec = item->spec;
 	raw_mask = item->mask;
 
+	if (!raw_spec || !raw_mask) {
+		rte_flow_error_set(error, EINVAL,
+				RTE_FLOW_ERROR_TYPE_ITEM,
+				item, "NULL RAW spec/mask");
+		return -rte_errno;
+	}
+
 	spec_len = strnlen((char *)(uintptr_t)raw_spec->pattern,
 		raw_spec->length + 1);
 	if (spec_len != raw_spec->length)
@@ -1185,7 +1193,7 @@ ice_hash_parse_pattern_action(__rte_unused struct ice_adapter *ad,
 
 	if (phint == ICE_PHINT_RAW) {
 		rss_meta_ptr->raw.raw_ena = true;
-		ret = ice_hash_parse_raw_pattern(ad, pattern, rss_meta_ptr);
+		ret = ice_hash_parse_raw_pattern(ad, pattern, error, rss_meta_ptr);
 		if (ret) {
 			rte_flow_error_set(error, EINVAL,
 					   RTE_FLOW_ERROR_TYPE_ITEM, NULL,
-- 
2.34.1