patch 'net/ixgbe: fix MAC/VLAN item validation for ntuple' has been queued to stable release 25.11.3

[Kevin Traynor]

Hi,

FYI, your patch has been queued to stable release 25.11.3

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 07/27/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/kevintraynor/dpdk-stable

This queued commit can be viewed at:
https://github.com/kevintraynor/dpdk-stable/commit/d97bb53226b6253f538d834b0e56e890c699e5f8

Thanks.

Kevin

---
>From d97bb53226b6253f538d834b0e56e890c699e5f8 Mon Sep 17 00:00:00 2001
From: Daniil Iskhakov <dish at amicon.ru>
Date: Thu, 7 May 2026 16:21:17 +0300
Subject: [PATCH] net/ixgbe: fix MAC/VLAN item validation for ntuple

[ upstream commit 0a360fdaa2f2794891f0a0f167337cda879f1340 ]

When parsing an ntuple filter, the code attempts to ensure that if the
first item is ETH or VLAN, its spec and mask are either absent or
contain only zero fields. The current check is:

  if ((item->spec || item->mask) &&
      (memcmp(spec, &null_struct, size) ||
       memcmp(mask, &null_struct, size)))

This condition is logically incorrect. If item->spec points to a
zero-filled structure and item->mask is NULL, memcmp(mask) would
dereference a NULL pointer.

The intended behavior is to reject any non-zero spec or mask.

Guard each memcmp() call with a check of the corresponding pointer while
keeping a single error path.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 46ea969177f3 ("net/ixgbe: add ntuple support to flow parser")

Signed-off-by: Daniil Agalakov <ade at amicon.ru>
Signed-off-by: Daniil Iskhakov <dish at amicon.ru>
Acked-by: Bruce Richardson <bruce.richardson at intel.com>
---
 drivers/net/intel/ixgbe/ixgbe_flow.c | 25 ++++++++-----------------
 1 file changed, 8 insertions(+), 17 deletions(-)

diff --git a/drivers/net/intel/ixgbe/ixgbe_flow.c b/drivers/net/intel/ixgbe/ixgbe_flow.c
index 4ec4ab0f3f..b4f80109c1 100644
--- a/drivers/net/intel/ixgbe/ixgbe_flow.c
+++ b/drivers/net/intel/ixgbe/ixgbe_flow.c
@@ -298,12 +298,8 @@ cons_parse_ntuple_filter(const struct rte_flow_attr *attr,
 		}
 		/* if the first item is MAC, the content should be NULL */
-		if ((item->spec || item->mask) &&
-			(memcmp(eth_spec, &eth_null,
-				sizeof(struct rte_flow_item_eth)) ||
-			 memcmp(eth_mask, &eth_null,
-				sizeof(struct rte_flow_item_eth)))) {
-			rte_flow_error_set(error, EINVAL,
-				RTE_FLOW_ERROR_TYPE_ITEM,
-				item, "Not supported by ntuple filter");
+		if ((item->spec != NULL && memcmp(eth_spec, &eth_null, sizeof(eth_null)) != 0) ||
+		    (item->mask != NULL && memcmp(eth_mask, &eth_null, sizeof(eth_null)) != 0)) {
+			rte_flow_error_set(error, EINVAL, RTE_FLOW_ERROR_TYPE_ITEM, item,
+					"Not supported by ntuple filter");
 			return -rte_errno;
 		}
@@ -331,13 +327,8 @@ cons_parse_ntuple_filter(const struct rte_flow_attr *attr,
 		}
 		/* the content should be NULL */
-		if ((item->spec || item->mask) &&
-			(memcmp(vlan_spec, &vlan_null,
-				sizeof(struct rte_flow_item_vlan)) ||
-			 memcmp(vlan_mask, &vlan_null,
-				sizeof(struct rte_flow_item_vlan)))) {
-
-			rte_flow_error_set(error, EINVAL,
-				RTE_FLOW_ERROR_TYPE_ITEM,
-				item, "Not supported by ntuple filter");
+		if ((item->spec != NULL && memcmp(vlan_spec, &vlan_null, sizeof(vlan_null)) != 0) ||
+		    (item->mask != NULL && memcmp(vlan_mask, &vlan_null, sizeof(vlan_null)) != 0)) {
+			rte_flow_error_set(error, EINVAL, RTE_FLOW_ERROR_TYPE_ITEM, item,
+					"Not supported by ntuple filter");
 			return -rte_errno;
 		}
-- 
2.55.0

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-07-23 17:58:00.184051924 +0100
+++ 0053-net-ixgbe-fix-MAC-VLAN-item-validation-for-ntuple.patch	2026-07-23 17:57:58.664918585 +0100
@@ -1 +1 @@
-From 0a360fdaa2f2794891f0a0f167337cda879f1340 Mon Sep 17 00:00:00 2001
+From d97bb53226b6253f538d834b0e56e890c699e5f8 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 0a360fdaa2f2794891f0a0f167337cda879f1340 ]
+
@@ -26 +27,0 @@
-Cc: stable at dpdk.org
@@ -36 +37 @@
-index 7c0cdf8b74..4a3a5403ef 100644
+index 4ec4ab0f3f..b4f80109c1 100644
@@ -39 +40 @@
-@@ -230,12 +230,8 @@ cons_parse_ntuple_filter(const struct rte_flow_attr *attr,
+@@ -298,12 +298,8 @@ cons_parse_ntuple_filter(const struct rte_flow_attr *attr,
@@ -56 +57 @@
-@@ -263,13 +259,8 @@ cons_parse_ntuple_filter(const struct rte_flow_attr *attr,
+@@ -331,13 +327,8 @@ cons_parse_ntuple_filter(const struct rte_flow_attr *attr,