patch 'net/i40e: validate DDP segment header before use' has been queued to stable release 24.11.7

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.7

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 06/13/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/79a4b4026a557f46d94b800ce444de081a332370

Thanks.

Luca Boccassi

---
>From 79a4b4026a557f46d94b800ce444de081a332370 Mon Sep 17 00:00:00 2001
From: Daniil Iskhakov <dish at amicon.ru>
Date: Mon, 27 Apr 2026 18:44:01 +0300
Subject: [PATCH] net/i40e: validate DDP segment header before use

[ upstream commit 9386bbed3306392d0c0d441c183bf6091d32aaf2 ]

rte_pmd_i40e_get_ddp_info() retrieves the I40E segment header with
i40e_find_segment_in_package(). That helper may return NULL if the
segment cannot be found.

The returned pointer is validated only in one code path, while other
branches use it without checking. This can lead to a NULL pointer
dereference when parsing a malformed or incomplete DDP package.

Move the NULL check right before the segment usage so it applies to all
request types needed.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: edeab742edac ("net/i40e: get information about DDP profile")

Signed-off-by: Daniil Agalakov <ade at amicon.ru>
Signed-off-by: Daniil Iskhakov <dish at amicon.ru>
Acked-by: Bruce Richardson <bruce.richardson at intel.com>
---
 .mailmap                        |  3 +++
 drivers/net/i40e/rte_pmd_i40e.c | 10 +++++-----
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/.mailmap b/.mailmap
index 82b5f09da3..bf13801dfd 100644
--- a/.mailmap
+++ b/.mailmap
@@ -311,6 +311,9 @@ Daniel Martin Buckley <daniel.m.buckley at intel.com>
 Daniel Mrzyglod <danielx.t.mrzyglod at intel.com>
 Daniel Shelepov <dashel at microsoft.com>
 Daniel Verkamp <daniel.verkamp at intel.com>
+Daniele Di Proietto <ddiproietto at vmware.com>
+Daniil Agalakov <ade at amicon.ru>
+Daniil Iskhakov <dish at amicon.ru>
 Daniil Ushkov <daniil.ushkov at yandex.ru>
 Dan Nowlin <dan.nowlin at intel.com>
 Danny Patel <dannyp at marvell.com>
diff --git a/drivers/net/i40e/rte_pmd_i40e.c b/drivers/net/i40e/rte_pmd_i40e.c
index 9d39984ea1..d0ab52b1e7 100644
--- a/drivers/net/i40e/rte_pmd_i40e.c
+++ b/drivers/net/i40e/rte_pmd_i40e.c
@@ -1883,6 +1883,11 @@ int rte_pmd_i40e_get_ddp_info(uint8_t *pkg_buff, uint32_t pkg_size,
 		return I40E_SUCCESS;
 	}
 
+	if (!i40e_seg_hdr) {
+		PMD_DRV_LOG(ERR, "Failed to find i40e segment header");
+		return -EINVAL;
+	}
+
 	/* get i40e segment header info */
 	if (type == RTE_PMD_I40E_PKG_INFO_HEADER) {
 		struct rte_pmd_i40e_profile_info *info =
@@ -1898,11 +1903,6 @@ int rte_pmd_i40e_get_ddp_info(uint8_t *pkg_buff, uint32_t pkg_size,
 			return -EINVAL;
 		}
 
-		if (!i40e_seg_hdr) {
-			PMD_DRV_LOG(ERR, "Failed to find i40e segment header");
-			return -EINVAL;
-		}
-
 		memset(info, 0, sizeof(struct rte_pmd_i40e_profile_info));
 		info->owner = RTE_PMD_I40E_DDP_OWNER_UNKNOWN;
 		info->track_id =
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-06-11 14:20:02.945941148 +0100
+++ 0041-net-i40e-validate-DDP-segment-header-before-use.patch	2026-06-11 14:20:01.214745982 +0100
@@ -1 +1 @@
-From 9386bbed3306392d0c0d441c183bf6091d32aaf2 Mon Sep 17 00:00:00 2001
+From 79a4b4026a557f46d94b800ce444de081a332370 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 9386bbed3306392d0c0d441c183bf6091d32aaf2 ]
+
@@ -20 +21,0 @@
-Cc: stable at dpdk.org
@@ -26,3 +27,3 @@
- .mailmap                              |  2 ++
- drivers/net/intel/i40e/rte_pmd_i40e.c | 10 +++++-----
- 2 files changed, 7 insertions(+), 5 deletions(-)
+ .mailmap                        |  3 +++
+ drivers/net/i40e/rte_pmd_i40e.c | 10 +++++-----
+ 2 files changed, 8 insertions(+), 5 deletions(-)
@@ -31 +32 @@
-index d60e8b9378..fb544d0057 100644
+index 82b5f09da3..bf13801dfd 100644
@@ -34 +35,2 @@
-@@ -327,6 +327,8 @@ Daniel Mrzyglod <danielx.t.mrzyglod at intel.com>
+@@ -311,6 +311,9 @@ Daniel Martin Buckley <daniel.m.buckley at intel.com>
+ Daniel Mrzyglod <danielx.t.mrzyglod at intel.com>
@@ -37 +39 @@
- Daniele Di Proietto <ddiproietto at vmware.com>
++Daniele Di Proietto <ddiproietto at vmware.com>
@@ -40,0 +43 @@
+ Dan Nowlin <dan.nowlin at intel.com>
@@ -42,6 +45,5 @@
- Danny Zhou <danny.zhou at intel.com>
-diff --git a/drivers/net/intel/i40e/rte_pmd_i40e.c b/drivers/net/intel/i40e/rte_pmd_i40e.c
-index 4fdef9464b..78b1f1f12d 100644
---- a/drivers/net/intel/i40e/rte_pmd_i40e.c
-+++ b/drivers/net/intel/i40e/rte_pmd_i40e.c
-@@ -1878,6 +1878,11 @@ int rte_pmd_i40e_get_ddp_info(uint8_t *pkg_buff, uint32_t pkg_size,
+diff --git a/drivers/net/i40e/rte_pmd_i40e.c b/drivers/net/i40e/rte_pmd_i40e.c
+index 9d39984ea1..d0ab52b1e7 100644
+--- a/drivers/net/i40e/rte_pmd_i40e.c
++++ b/drivers/net/i40e/rte_pmd_i40e.c
+@@ -1883,6 +1883,11 @@ int rte_pmd_i40e_get_ddp_info(uint8_t *pkg_buff, uint32_t pkg_size,
@@ -59 +61 @@
-@@ -1893,11 +1898,6 @@ int rte_pmd_i40e_get_ddp_info(uint8_t *pkg_buff, uint32_t pkg_size,
+@@ -1898,11 +1903,6 @@ int rte_pmd_i40e_get_ddp_info(uint8_t *pkg_buff, uint32_t pkg_size,