patch 'net/af_packet: fix parsing of numeric device args' has been queued to stable release 25.11.3

[Kevin Traynor]

Hi,

FYI, your patch has been queued to stable release 25.11.3

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 08/01/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/kevintraynor/dpdk-stable

This queued commit can be viewed at:
https://github.com/kevintraynor/dpdk-stable/commit/e95ca8df814dc131871d224d5a7d7a779739f1f6

Thanks.

Kevin

---
>From e95ca8df814dc131871d224d5a7d7a779739f1f6 Mon Sep 17 00:00:00 2001
From: Stephen Hemminger <stephen at networkplumber.org>
Date: Wed, 3 Jun 2026 11:13:06 -0700
Subject: [PATCH] net/af_packet: fix parsing of numeric device args

[ upstream commit ea8a023655f5730a78c1e6b16adfefd8aecc6cc0 ]

This driver has several numeric arguments but it was using
atoi() which allows garbage and negative values.
Convert to a helper using strtoul() with upper bound.

First found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 364e08f2bbc0 ("af_packet: add PMD for AF_PACKET-based virtual devices")

Reported-by: Denis Sergeev <denserg.edu at gmail.com>
Signed-off-by: Stephen Hemminger <stephen at networkplumber.org>
Acked-by: Bruce Richardson <bruce.richardson at intel.com>
---
 drivers/net/af_packet/rte_eth_af_packet.c | 58 +++++++++++++++++++----
 1 file changed, 48 insertions(+), 10 deletions(-)

diff --git a/drivers/net/af_packet/rte_eth_af_packet.c b/drivers/net/af_packet/rte_eth_af_packet.c
index 6ed601be95..bc02238be6 100644
--- a/drivers/net/af_packet/rte_eth_af_packet.c
+++ b/drivers/net/af_packet/rte_eth_af_packet.c
@@ -16,5 +16,7 @@
 #include <bus_vdev_driver.h>
 
+#include <ctype.h>
 #include <errno.h>
+#include <limits.h>
 #include <linux/if_ether.h>
 #include <linux/if_packet.h>
@@ -1081,4 +1083,40 @@ free_internals:
 }
 
+/* Parse an unsigned integer device argument. */
+static int
+parse_uint(const char *key, const char *value,
+	   unsigned int *out, unsigned long limit)
+{
+	unsigned long val;
+	char *endptr;
+
+	if (value == NULL) {
+		PMD_LOG(ERR, "no value for argument \"%s\"", key);
+		return -1;
+	}
+
+	/* Skip leading whitespace so a leading sign can be detected. */
+	while (isspace((unsigned char)*value))
+		value++;
+
+	/* strtoul() silently accepts and negates a leading '-'. */
+	if (*value == '\0' || *value == '-') {
+		PMD_LOG(ERR, "invalid value \"%s\" for argument \"%s\"",
+			value, key);
+		return -1;
+	}
+
+	errno = 0;
+	val = strtoul(value, &endptr, 10);
+	if (errno != 0 || *endptr != '\0' || val > limit) {
+		PMD_LOG(ERR, "invalid value \"%s\" for argument \"%s\"",
+			value, key);
+		return -1;
+	}
+
+	*out = (unsigned int)val;
+	return 0;
+}
+
 static int
 rte_eth_from_packet(struct rte_vdev_device *dev,
@@ -1111,5 +1149,7 @@ rte_eth_from_packet(struct rte_vdev_device *dev,
 		pair = &kvlist->pairs[k_idx];
 		if (strstr(pair->key, ETH_AF_PACKET_NUM_Q_ARG) != NULL) {
-			qpairs = atoi(pair->value);
+			if (parse_uint(pair->key, pair->value,
+				       &qpairs, RTE_MAX_QUEUES_PER_PORT) < 0)
+				return -1;
 			if (qpairs < 1) {
 				PMD_LOG(ERR,
@@ -1121,5 +1161,6 @@ rte_eth_from_packet(struct rte_vdev_device *dev,
 		}
 		if (strstr(pair->key, ETH_AF_PACKET_BLOCKSIZE_ARG) != NULL) {
-			blocksize = atoi(pair->value);
+			if (parse_uint(pair->key, pair->value, &blocksize, UINT_MAX) < 0)
+				return -1;
 			if (!blocksize) {
 				PMD_LOG(ERR,
@@ -1131,5 +1172,6 @@ rte_eth_from_packet(struct rte_vdev_device *dev,
 		}
 		if (strstr(pair->key, ETH_AF_PACKET_FRAMESIZE_ARG) != NULL) {
-			framesize = atoi(pair->value);
+			if (parse_uint(pair->key, pair->value, &framesize, UINT_MAX) < 0)
+				return -1;
 			if (!framesize) {
 				PMD_LOG(ERR,
@@ -1141,5 +1183,6 @@ rte_eth_from_packet(struct rte_vdev_device *dev,
 		}
 		if (strstr(pair->key, ETH_AF_PACKET_FRAMECOUNT_ARG) != NULL) {
-			framecount = atoi(pair->value);
+			if (parse_uint(pair->key, pair->value, &framecount, UINT_MAX) < 0)
+				return -1;
 			if (!framecount) {
 				PMD_LOG(ERR,
@@ -1151,11 +1194,6 @@ rte_eth_from_packet(struct rte_vdev_device *dev,
 		}
 		if (strstr(pair->key, ETH_AF_PACKET_QDISC_BYPASS_ARG) != NULL) {
-			qdisc_bypass = atoi(pair->value);
-			if (qdisc_bypass > 1) {
-				PMD_LOG(ERR,
-					"%s: invalid bypass value",
-					name);
+			if (parse_uint(pair->key, pair->value, &qdisc_bypass, 1) < 0)
 				return -1;
-			}
 			continue;
 		}
-- 
2.55.0

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-07-28 16:54:53.470329337 +0100
+++ 0092-net-af_packet-fix-parsing-of-numeric-device-args.patch	2026-07-28 16:54:50.848640519 +0100
@@ -1 +1 @@
-From ea8a023655f5730a78c1e6b16adfefd8aecc6cc0 Mon Sep 17 00:00:00 2001
+From e95ca8df814dc131871d224d5a7d7a779739f1f6 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit ea8a023655f5730a78c1e6b16adfefd8aecc6cc0 ]
+
@@ -13 +14,0 @@
-Cc: stable at dpdk.org
@@ -23 +24 @@
-index 8303ff5ca9..b0ff22ea55 100644
+index 6ed601be95..bc02238be6 100644
@@ -34 +35 @@
-@@ -1139,4 +1141,40 @@ free_internals:
+@@ -1081,4 +1083,40 @@ free_internals:
@@ -75 +76 @@
-@@ -1169,5 +1207,7 @@ rte_eth_from_packet(struct rte_vdev_device *dev,
+@@ -1111,5 +1149,7 @@ rte_eth_from_packet(struct rte_vdev_device *dev,
@@ -84 +85 @@
-@@ -1179,5 +1219,6 @@ rte_eth_from_packet(struct rte_vdev_device *dev,
+@@ -1121,5 +1161,6 @@ rte_eth_from_packet(struct rte_vdev_device *dev,
@@ -92 +93 @@
-@@ -1189,5 +1230,6 @@ rte_eth_from_packet(struct rte_vdev_device *dev,
+@@ -1131,5 +1172,6 @@ rte_eth_from_packet(struct rte_vdev_device *dev,
@@ -100 +101 @@
-@@ -1199,5 +1241,6 @@ rte_eth_from_packet(struct rte_vdev_device *dev,
+@@ -1141,5 +1183,6 @@ rte_eth_from_packet(struct rte_vdev_device *dev,
@@ -108 +109 @@
-@@ -1209,11 +1252,6 @@ rte_eth_from_packet(struct rte_vdev_device *dev,
+@@ -1151,11 +1194,6 @@ rte_eth_from_packet(struct rte_vdev_device *dev,