patch 'app/testpmd: fix flex item link parsing' has been queued to stable release 23.11.6

[Shani Peretz]

Hi,

FYI, your patch has been queued to stable release 23.11.6

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 12/30/25. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/shanipr/dpdk-stable

This queued commit can be viewed at:
https://github.com/shanipr/dpdk-stable/commit/5acfbf1283c41f32ee8a0faa982025b444ce9cf1

Thanks.

Shani

---
>From 5acfbf1283c41f32ee8a0faa982025b444ce9cf1 Mon Sep 17 00:00:00 2001
From: Maayan Kashani <mkashani at nvidia.com>
Date: Wed, 26 Nov 2025 16:13:59 +0200
Subject: [PATCH] app/testpmd: fix flex item link parsing

[ upstream commit 39454e245b ]

The flex_link_item_parse function was using FLEX_MAX_FLOW_PATTERN_LENGTH
for all memcpy operations regardless of the actual flow item type. This
could lead to copying incorrect amounts of data.

This patch enlarge data buffer to avoid the buffer overflow while
continue to report same buffer size to flow parse.

Fixes: 59f3a8a ("app/testpmd: add flex item commands")
Cc: stable at dpdk.org

Signed-off-by: Maayan Kashani <mkashani at nvidia.com>
---
 app/test-pmd/cmd_flex_item.c | 24 +++++++++++++++++++++---
 1 file changed, 21 insertions(+), 3 deletions(-)

diff --git a/app/test-pmd/cmd_flex_item.c b/app/test-pmd/cmd_flex_item.c
index e6e1cefeb3..a799b31ffd 100644
--- a/app/test-pmd/cmd_flex_item.c
+++ b/app/test-pmd/cmd_flex_item.c
@@ -134,6 +134,7 @@ flex_link_item_parse(const char *src, struct rte_flow_item *item)
 	struct rte_flow_attr *attr;
 	struct rte_flow_item *pattern;
 	struct rte_flow_action *actions;
+	size_t sz;
 
 	sprintf(flow_rule,
 		"flow create 0 pattern %s / end actions drop / end", src);
@@ -143,21 +144,38 @@ flex_link_item_parse(const char *src, struct rte_flow_item *item)
 	if (ret)
 		return ret;
 	item->type = pattern->type;
+	switch (item->type) {
+	case RTE_FLOW_ITEM_TYPE_IPV4:
+		sz = sizeof(struct rte_flow_item_ipv4);
+	break;
+	case RTE_FLOW_ITEM_TYPE_IPV6:
+		sz = sizeof(struct rte_flow_item_ipv6);
+	break;
+	case RTE_FLOW_ITEM_TYPE_UDP:
+		sz = sizeof(struct rte_flow_item_udp);
+       break;
+	case RTE_FLOW_ITEM_TYPE_TCP:
+		sz = sizeof(struct rte_flow_item_tcp);
+	break;
+	default:
+		printf("Unsupported item type in specified in link\n");
+		return -EINVAL;
+	}
 	if (pattern->spec) {
 		ptr = (void *)(uintptr_t)item->spec;
-		memcpy(ptr, pattern->spec, FLEX_MAX_FLOW_PATTERN_LENGTH);
+		memcpy(ptr, pattern->spec, sz);
 	} else {
 		item->spec = NULL;
 	}
 	if (pattern->mask) {
 		ptr = (void *)(uintptr_t)item->mask;
-		memcpy(ptr, pattern->mask, FLEX_MAX_FLOW_PATTERN_LENGTH);
+		memcpy(ptr, pattern->mask, sz);
 	} else {
 		item->mask = NULL;
 	}
 	if (pattern->last) {
 		ptr = (void *)(uintptr_t)item->last;
-		memcpy(ptr, pattern->last, FLEX_MAX_FLOW_PATTERN_LENGTH);
+		memcpy(ptr, pattern->last, sz);
 	} else {
 		item->last = NULL;
 	}
-- 
2.43.0

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2025-12-25 11:16:40.081713393 +0200
+++ 0075-app-testpmd-fix-flex-item-link-parsing.patch	2025-12-25 11:16:36.104907000 +0200
@@ -1 +1 @@
-From 39454e245b125ae555bc5a3a058cc3c1e1280f82 Mon Sep 17 00:00:00 2001
+From 5acfbf1283c41f32ee8a0faa982025b444ce9cf1 Mon Sep 17 00:00:00 2001
@@ -3 +3 @@
-Date: Sun, 16 Nov 2025 14:14:37 +0200
+Date: Wed, 26 Nov 2025 16:13:59 +0200
@@ -5,0 +6,2 @@
+[ upstream commit 39454e245b ]
+
@@ -10,5 +12,2 @@
-This patch adds a switch statement to determine the correct size based
-on the actual flow item type (IPv4, IPv6, UDP, TCP) and uses that size
-for the memcpy operations on spec, mask, and last fields.
-
-Also adds validation to reject unsupported item types.
+This patch enlarge data buffer to avoid the buffer overflow while
+continue to report same buffer size to flow parse.
@@ -16 +15 @@
-Fixes: 59f3a8acbcdb ("app/testpmd: add flex item commands")
+Fixes: 59f3a8a ("app/testpmd: add flex item commands")
@@ -21,2 +20,2 @@
- app/test-pmd/cmd_flex_item.c | 13 +++++++------
- 1 file changed, 7 insertions(+), 6 deletions(-)
+ app/test-pmd/cmd_flex_item.c | 24 +++++++++++++++++++++---
+ 1 file changed, 21 insertions(+), 3 deletions(-)
@@ -25 +24 @@
-index e6e1cefeb3..af6c087feb 100644
+index e6e1cefeb3..a799b31ffd 100644
@@ -28 +27,9 @@
-@@ -143,21 +143,22 @@ flex_link_item_parse(const char *src, struct rte_flow_item *item)
+@@ -134,6 +134,7 @@ flex_link_item_parse(const char *src, struct rte_flow_item *item)
+ 	struct rte_flow_attr *attr;
+ 	struct rte_flow_item *pattern;
+ 	struct rte_flow_action *actions;
++	size_t sz;
+ 
+ 	sprintf(flow_rule,
+ 		"flow create 0 pattern %s / end actions drop / end", src);
+@@ -143,21 +144,38 @@ flex_link_item_parse(const char *src, struct rte_flow_item *item)
@@ -32,3 +39,18 @@
--	if (pattern->spec) {
-+	ret = rte_flow_conv(RTE_FLOW_CONV_OP_ITEM_MASK, NULL, 0, item, NULL);
-+	if ((ret > 0) && pattern->spec) {
++	switch (item->type) {
++	case RTE_FLOW_ITEM_TYPE_IPV4:
++		sz = sizeof(struct rte_flow_item_ipv4);
++	break;
++	case RTE_FLOW_ITEM_TYPE_IPV6:
++		sz = sizeof(struct rte_flow_item_ipv6);
++	break;
++	case RTE_FLOW_ITEM_TYPE_UDP:
++		sz = sizeof(struct rte_flow_item_udp);
++       break;
++	case RTE_FLOW_ITEM_TYPE_TCP:
++		sz = sizeof(struct rte_flow_item_tcp);
++	break;
++	default:
++		printf("Unsupported item type in specified in link\n");
++		return -EINVAL;
++	}
+ 	if (pattern->spec) {
@@ -37 +59 @@
-+		memcpy(ptr, pattern->spec, ret);
++		memcpy(ptr, pattern->spec, sz);
@@ -41,2 +63 @@
--	if (pattern->mask) {
-+	if ((ret > 0) && pattern->mask) {
+ 	if (pattern->mask) {
@@ -45 +66 @@
-+		memcpy(ptr, pattern->mask, ret);
++		memcpy(ptr, pattern->mask, sz);
@@ -49,2 +70 @@
--	if (pattern->last) {
-+	if ((ret > 0) && pattern->last) {
+ 	if (pattern->last) {
@@ -53 +73 @@
-+		memcpy(ptr, pattern->last, ret);
++		memcpy(ptr, pattern->last, sz);