patch 'ethdev: fix out-of-bounds write in flex item conversion' has been queued to stable release 24.11.7

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.7

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 07/05/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/9dd15e8f79082da0cfe961f3d98063b2041b588f

Thanks.

Luca Boccassi

---
>From 9dd15e8f79082da0cfe961f3d98063b2041b588f Mon Sep 17 00:00:00 2001
From: James Raphael Tiovalen <jamestiotio at gmail.com>
Date: Wed, 10 Jun 2026 19:33:34 +0800
Subject: [PATCH] ethdev: fix out-of-bounds write in flex item conversion

[ upstream commit f4e424fbf72a603b2411333e188dad3418e468ca ]

rte_flow_item_flex_conv() is dispatched from rte_flow_conv_copy() to
deep-copy the variable-length pattern that follows a flex item header.
The function took no size argument at all, so the trailing rte_memcpy()
of `src->length` bytes was gated only on `buf != NULL`, violating the
documented contract that output is truncated to the caller-supplied
buffer size. A caller passing a buffer just large enough for the header
struct had adjacent memory clobbered by up to 4 GiB of pattern data,
since `src->length` is uint32_t and unbounded.

Propagate the remaining buffer size `size - sz` from
rte_flow_conv_copy() into the desc_fn callback and gate the inner
memcpy on it.

Fixes: dc4d860e8a89 ("ethdev: introduce configurable flexible item")

Signed-off-by: James Raphael Tiovalen <jamestiotio at gmail.com>
---
 lib/ethdev/rte_flow.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/lib/ethdev/rte_flow.c b/lib/ethdev/rte_flow.c
index 17f4ede91f..e334f26a5f 100644
--- a/lib/ethdev/rte_flow.c
+++ b/lib/ethdev/rte_flow.c
@@ -33,7 +33,7 @@ uint64_t rte_flow_dynf_metadata_mask;
 struct rte_flow_desc_data {
 	const char *name;
 	size_t size;
-	size_t (*desc_fn)(void *dst, const void *src);
+	size_t (*desc_fn)(void *dst, const void *src, size_t size);
 };
 
 /**
@@ -65,16 +65,17 @@ rte_flow_conv_copy(void *buf, const void *data, const size_t size,
 	if (buf != NULL)
 		rte_memcpy(buf, data, (size > sz ? sz : size));
 	if (rte_type && desc[type].desc_fn)
-		sz += desc[type].desc_fn(size > 0 ? buf : NULL, data);
+		sz += desc[type].desc_fn(size > 0 ? buf : NULL, data,
+					 size > sz ? size - sz : 0);
 	return sz;
 }
 
 static size_t
-rte_flow_item_flex_conv(void *buf, const void *data)
+rte_flow_item_flex_conv(void *buf, const void *data, size_t size)
 {
 	struct rte_flow_item_flex *dst = buf;
 	const struct rte_flow_item_flex *src = data;
-	if (buf) {
+	if (buf && size >= src->length) {
 		dst->pattern = rte_memcpy
 			((void *)((uintptr_t)(dst + 1)), src->pattern,
 			 src->length);
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-07-03 12:55:48.465604509 +0100
+++ 0047-ethdev-fix-out-of-bounds-write-in-flex-item-conversi.patch	2026-07-03 12:55:46.678574191 +0100
@@ -1 +1 @@
-From f4e424fbf72a603b2411333e188dad3418e468ca Mon Sep 17 00:00:00 2001
+From 9dd15e8f79082da0cfe961f3d98063b2041b588f Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit f4e424fbf72a603b2411333e188dad3418e468ca ]
+
@@ -20 +21,0 @@
-Cc: stable at dpdk.org
@@ -28 +29 @@
-index 57ce610d6d..651630b2f8 100644
+index 17f4ede91f..e334f26a5f 100644
@@ -31 +32 @@
-@@ -36,7 +36,7 @@ uint64_t rte_flow_dynf_metadata_mask;
+@@ -33,7 +33,7 @@ uint64_t rte_flow_dynf_metadata_mask;
@@ -40 +41 @@
-@@ -68,16 +68,17 @@ rte_flow_conv_copy(void *buf, const void *data, const size_t size,
+@@ -65,16 +65,17 @@ rte_flow_conv_copy(void *buf, const void *data, const size_t size,