patch 'net/i40e: validate DDP segment header before use' has been queued to stable release 25.11.3

[Kevin Traynor]

Hi,

FYI, your patch has been queued to stable release 25.11.3

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 07/27/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/kevintraynor/dpdk-stable

This queued commit can be viewed at:
https://github.com/kevintraynor/dpdk-stable/commit/1440bce3ff15b36c0a2ba14b6149da50d11c0dd7

Thanks.

Kevin

---
>From 1440bce3ff15b36c0a2ba14b6149da50d11c0dd7 Mon Sep 17 00:00:00 2001
From: Daniil Iskhakov <dish at amicon.ru>
Date: Mon, 27 Apr 2026 18:44:01 +0300
Subject: [PATCH] net/i40e: validate DDP segment header before use

[ upstream commit 9386bbed3306392d0c0d441c183bf6091d32aaf2 ]

rte_pmd_i40e_get_ddp_info() retrieves the I40E segment header with
i40e_find_segment_in_package(). That helper may return NULL if the
segment cannot be found.

The returned pointer is validated only in one code path, while other
branches use it without checking. This can lead to a NULL pointer
dereference when parsing a malformed or incomplete DDP package.

Move the NULL check right before the segment usage so it applies to all
request types needed.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: edeab742edac ("net/i40e: get information about DDP profile")

Signed-off-by: Daniil Agalakov <ade at amicon.ru>
Signed-off-by: Daniil Iskhakov <dish at amicon.ru>
Acked-by: Bruce Richardson <bruce.richardson at intel.com>
---
 .mailmap                              |  2 ++
 drivers/net/intel/i40e/rte_pmd_i40e.c | 10 +++++-----
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/.mailmap b/.mailmap
index 594abaf4dd..50c73e6343 100644
--- a/.mailmap
+++ b/.mailmap
@@ -325,4 +325,6 @@ Daniel Shelepov <dashel at microsoft.com>
 Daniel Verkamp <daniel.verkamp at intel.com>
 Daniele Di Proietto <ddiproietto at vmware.com>
+Daniil Agalakov <ade at amicon.ru>
+Daniil Iskhakov <dish at amicon.ru>
 Daniil Ushkov <daniil.ushkov at yandex.ru>
 Danny Patel <dannyp at marvell.com>
diff --git a/drivers/net/intel/i40e/rte_pmd_i40e.c b/drivers/net/intel/i40e/rte_pmd_i40e.c
index a358f68bc5..7aa53322ae 100644
--- a/drivers/net/intel/i40e/rte_pmd_i40e.c
+++ b/drivers/net/intel/i40e/rte_pmd_i40e.c
@@ -1905,4 +1905,9 @@ int rte_pmd_i40e_get_ddp_info(uint8_t *pkg_buff, uint32_t pkg_size,
 	}
 
+	if (!i40e_seg_hdr) {
+		PMD_DRV_LOG(ERR, "Failed to find i40e segment header");
+		return -EINVAL;
+	}
+
 	/* get i40e segment header info */
 	if (type == RTE_PMD_I40E_PKG_INFO_HEADER) {
@@ -1920,9 +1925,4 @@ int rte_pmd_i40e_get_ddp_info(uint8_t *pkg_buff, uint32_t pkg_size,
 		}
 
-		if (!i40e_seg_hdr) {
-			PMD_DRV_LOG(ERR, "Failed to find i40e segment header");
-			return -EINVAL;
-		}
-
 		memset(info, 0, sizeof(struct rte_pmd_i40e_profile_info));
 		info->owner = RTE_PMD_I40E_DDP_OWNER_UNKNOWN;
-- 
2.55.0

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-07-23 17:57:59.840611461 +0100
+++ 0041-net-i40e-validate-DDP-segment-header-before-use.patch	2026-07-23 17:57:58.649918610 +0100
@@ -1 +1 @@
-From 9386bbed3306392d0c0d441c183bf6091d32aaf2 Mon Sep 17 00:00:00 2001
+From 1440bce3ff15b36c0a2ba14b6149da50d11c0dd7 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 9386bbed3306392d0c0d441c183bf6091d32aaf2 ]
+
@@ -20 +21,0 @@
-Cc: stable at dpdk.org
@@ -31 +32 @@
-index d60e8b9378..fb544d0057 100644
+index 594abaf4dd..50c73e6343 100644
@@ -34 +35 @@
-@@ -328,4 +328,6 @@ Daniel Shelepov <dashel at microsoft.com>
+@@ -325,4 +325,6 @@ Daniel Shelepov <dashel at microsoft.com>
@@ -42 +43 @@
-index 4fdef9464b..78b1f1f12d 100644
+index a358f68bc5..7aa53322ae 100644
@@ -45 +46 @@
-@@ -1879,4 +1879,9 @@ int rte_pmd_i40e_get_ddp_info(uint8_t *pkg_buff, uint32_t pkg_size,
+@@ -1905,4 +1905,9 @@ int rte_pmd_i40e_get_ddp_info(uint8_t *pkg_buff, uint32_t pkg_size,
@@ -55 +56 @@
-@@ -1894,9 +1899,4 @@ int rte_pmd_i40e_get_ddp_info(uint8_t *pkg_buff, uint32_t pkg_size,
+@@ -1920,9 +1925,4 @@ int rte_pmd_i40e_get_ddp_info(uint8_t *pkg_buff, uint32_t pkg_size,