patch 'net/af_packet: fix parsing of numeric device args' has been queued to stable release 24.11.7

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.7

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 07/05/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/69852e2731ac338c33599a455bd5558840351194

Thanks.

Luca Boccassi

---
>From 69852e2731ac338c33599a455bd5558840351194 Mon Sep 17 00:00:00 2001
From: Stephen Hemminger <stephen at networkplumber.org>
Date: Wed, 3 Jun 2026 11:13:06 -0700
Subject: [PATCH] net/af_packet: fix parsing of numeric device args

[ upstream commit ea8a023655f5730a78c1e6b16adfefd8aecc6cc0 ]

This driver has several numeric arguments but it was using
atoi() which allows garbage and negative values.
Convert to a helper using strtoul() with upper bound.

First found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 364e08f2bbc0 ("af_packet: add PMD for AF_PACKET-based virtual devices")

Reported-by: Denis Sergeev <denserg.edu at gmail.com>
Signed-off-by: Stephen Hemminger <stephen at networkplumber.org>
Acked-by: Bruce Richardson <bruce.richardson at intel.com>
---
 drivers/net/af_packet/rte_eth_af_packet.c | 58 +++++++++++++++++++----
 1 file changed, 48 insertions(+), 10 deletions(-)

diff --git a/drivers/net/af_packet/rte_eth_af_packet.c b/drivers/net/af_packet/rte_eth_af_packet.c
index 816d748305..a04e835a66 100644
--- a/drivers/net/af_packet/rte_eth_af_packet.c
+++ b/drivers/net/af_packet/rte_eth_af_packet.c
@@ -15,7 +15,9 @@
 #include <rte_kvargs.h>
 #include <bus_vdev_driver.h>
 
+#include <ctype.h>
 #include <errno.h>
+#include <limits.h>
 #include <linux/if_ether.h>
 #include <linux/if_packet.h>
 #include <arpa/inet.h>
@@ -988,6 +990,42 @@ free_internals:
 	return -1;
 }
 
+/* Parse an unsigned integer device argument. */
+static int
+parse_uint(const char *key, const char *value,
+	   unsigned int *out, unsigned long limit)
+{
+	unsigned long val;
+	char *endptr;
+
+	if (value == NULL) {
+		PMD_LOG(ERR, "no value for argument \"%s\"", key);
+		return -1;
+	}
+
+	/* Skip leading whitespace so a leading sign can be detected. */
+	while (isspace((unsigned char)*value))
+		value++;
+
+	/* strtoul() silently accepts and negates a leading '-'. */
+	if (*value == '\0' || *value == '-') {
+		PMD_LOG(ERR, "invalid value \"%s\" for argument \"%s\"",
+			value, key);
+		return -1;
+	}
+
+	errno = 0;
+	val = strtoul(value, &endptr, 10);
+	if (errno != 0 || *endptr != '\0' || val > limit) {
+		PMD_LOG(ERR, "invalid value \"%s\" for argument \"%s\"",
+			value, key);
+		return -1;
+	}
+
+	*out = (unsigned int)val;
+	return 0;
+}
+
 static int
 rte_eth_from_packet(struct rte_vdev_device *dev,
 		    int const *sockfd,
@@ -1017,7 +1055,9 @@ rte_eth_from_packet(struct rte_vdev_device *dev,
 	for (k_idx = 0; k_idx < kvlist->count; k_idx++) {
 		pair = &kvlist->pairs[k_idx];
 		if (strstr(pair->key, ETH_AF_PACKET_NUM_Q_ARG) != NULL) {
-			qpairs = atoi(pair->value);
+			if (parse_uint(pair->key, pair->value,
+				       &qpairs, RTE_MAX_QUEUES_PER_PORT) < 0)
+				return -1;
 			if (qpairs < 1) {
 				PMD_LOG(ERR,
 					"%s: invalid qpairs value",
@@ -1027,7 +1067,8 @@ rte_eth_from_packet(struct rte_vdev_device *dev,
 			continue;
 		}
 		if (strstr(pair->key, ETH_AF_PACKET_BLOCKSIZE_ARG) != NULL) {
-			blocksize = atoi(pair->value);
+			if (parse_uint(pair->key, pair->value, &blocksize, UINT_MAX) < 0)
+				return -1;
 			if (!blocksize) {
 				PMD_LOG(ERR,
 					"%s: invalid blocksize value",
@@ -1037,7 +1078,8 @@ rte_eth_from_packet(struct rte_vdev_device *dev,
 			continue;
 		}
 		if (strstr(pair->key, ETH_AF_PACKET_FRAMESIZE_ARG) != NULL) {
-			framesize = atoi(pair->value);
+			if (parse_uint(pair->key, pair->value, &framesize, UINT_MAX) < 0)
+				return -1;
 			if (!framesize) {
 				PMD_LOG(ERR,
 					"%s: invalid framesize value",
@@ -1047,7 +1089,8 @@ rte_eth_from_packet(struct rte_vdev_device *dev,
 			continue;
 		}
 		if (strstr(pair->key, ETH_AF_PACKET_FRAMECOUNT_ARG) != NULL) {
-			framecount = atoi(pair->value);
+			if (parse_uint(pair->key, pair->value, &framecount, UINT_MAX) < 0)
+				return -1;
 			if (!framecount) {
 				PMD_LOG(ERR,
 					"%s: invalid framecount value",
@@ -1057,13 +1100,8 @@ rte_eth_from_packet(struct rte_vdev_device *dev,
 			continue;
 		}
 		if (strstr(pair->key, ETH_AF_PACKET_QDISC_BYPASS_ARG) != NULL) {
-			qdisc_bypass = atoi(pair->value);
-			if (qdisc_bypass > 1) {
-				PMD_LOG(ERR,
-					"%s: invalid bypass value",
-					name);
+			if (parse_uint(pair->key, pair->value, &qdisc_bypass, 1) < 0)
 				return -1;
-			}
 			continue;
 		}
 	}
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-07-03 12:55:48.699585791 +0100
+++ 0053-net-af_packet-fix-parsing-of-numeric-device-args.patch	2026-07-03 12:55:46.694574611 +0100
@@ -1 +1 @@
-From ea8a023655f5730a78c1e6b16adfefd8aecc6cc0 Mon Sep 17 00:00:00 2001
+From 69852e2731ac338c33599a455bd5558840351194 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit ea8a023655f5730a78c1e6b16adfefd8aecc6cc0 ]
+
@@ -13 +14,0 @@
-Cc: stable at dpdk.org
@@ -23 +24 @@
-index 8303ff5ca9..b0ff22ea55 100644
+index 816d748305..a04e835a66 100644
@@ -36 +37 @@
-@@ -1138,6 +1140,42 @@ free_internals:
+@@ -988,6 +990,42 @@ free_internals:
@@ -79 +80 @@
-@@ -1168,7 +1206,9 @@ rte_eth_from_packet(struct rte_vdev_device *dev,
+@@ -1017,7 +1055,9 @@ rte_eth_from_packet(struct rte_vdev_device *dev,
@@ -90 +91 @@
-@@ -1178,7 +1218,8 @@ rte_eth_from_packet(struct rte_vdev_device *dev,
+@@ -1027,7 +1067,8 @@ rte_eth_from_packet(struct rte_vdev_device *dev,
@@ -100 +101 @@
-@@ -1188,7 +1229,8 @@ rte_eth_from_packet(struct rte_vdev_device *dev,
+@@ -1037,7 +1078,8 @@ rte_eth_from_packet(struct rte_vdev_device *dev,
@@ -110 +111 @@
-@@ -1198,7 +1240,8 @@ rte_eth_from_packet(struct rte_vdev_device *dev,
+@@ -1047,7 +1089,8 @@ rte_eth_from_packet(struct rte_vdev_device *dev,
@@ -120 +121 @@
-@@ -1208,13 +1251,8 @@ rte_eth_from_packet(struct rte_vdev_device *dev,
+@@ -1057,13 +1100,8 @@ rte_eth_from_packet(struct rte_vdev_device *dev,
@@ -134 +135 @@
- 		if (strstr(pair->key, ETH_AF_PACKET_FANOUT_MODE_ARG) != NULL) {
+ 	}