patch 'app/testpmd: fix flex item config buffer overflow' has been queued to stable release 24.11.9

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.9

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 10/29/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/366feda7764433809652f11b973be7b7dff3ac2c

Thanks.

Luca Boccassi

---
>From 366feda7764433809652f11b973be7b7dff3ac2c Mon Sep 17 00:00:00 2001
From: Kiran Kumar K <kirankumark at marvell.com>
Date: Mon, 7 Sep 2026 09:20:33 +0530
Subject: [PATCH] app/testpmd: fix flex item config buffer overflow

[ upstream commit b8a6b1f18be70439431191a1d326d714f4d4b0d7 ]

flex_item_init() allocates the sample_data, input_link and output_link
arrays with fixed size. Reject the configuration if an array
exceeds its capacity.

Fixes: 59f3a8acbcdb ("app/testpmd: add flex item commands")

Signed-off-by: Kiran Kumar K <kirankumark at marvell.com>
---
 app/test-pmd/cmd_flex_item.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/app/test-pmd/cmd_flex_item.c b/app/test-pmd/cmd_flex_item.c
index af6c087feba..c0bbff7b45f 100644
--- a/app/test-pmd/cmd_flex_item.c
+++ b/app/test-pmd/cmd_flex_item.c
@@ -231,6 +231,12 @@ static int flex_item_config(json_t *jroot,
 		} else if (match_strkey(key, "sample_data")) {
 			json_t *ji;
 			uint32_t i, size = json_array_size(jobj);
+			if (size > FLEX_ITEM_MAX_SAMPLES_NUM) {
+				printf("Number of sample_data entries (%u) exceeds maximum %u\n",
+				       size, FLEX_ITEM_MAX_SAMPLES_NUM);
+				ret = -EINVAL;
+				goto out;
+			}
 			for (i = 0; i < size; i++) {
 				ji = json_array_get(jobj, i);
 				ret = flex_field_parse
@@ -244,6 +250,12 @@ static int flex_item_config(json_t *jroot,
 		} else if (match_strkey(key, "input_link")) {
 			json_t *ji;
 			uint32_t i, size = json_array_size(jobj);
+			if (size > FLEX_ITEM_MAX_LINKS_NUM) {
+				printf("Number of input_link entries (%u) exceeds maximum %u\n",
+				       size, FLEX_ITEM_MAX_LINKS_NUM);
+				ret = -EINVAL;
+				goto out;
+			}
 			for (i = 0; i < size; i++) {
 				ji = json_array_get(jobj, i);
 				ret = flex_link_parse(ji,
@@ -258,6 +270,12 @@ static int flex_item_config(json_t *jroot,
 		} else if (match_strkey(key, "output_link")) {
 			json_t *ji;
 			uint32_t i, size = json_array_size(jobj);
+			if (size > FLEX_ITEM_MAX_LINKS_NUM) {
+				printf("Number of output_link entries (%u) exceeds maximum %u\n",
+				       size, FLEX_ITEM_MAX_LINKS_NUM);
+				ret = -EINVAL;
+				goto out;
+			}
 			for (i = 0; i < size; i++) {
 				ji = json_array_get(jobj, i);
 				ret = flex_link_parse
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-10-27 11:43:55.143555501 +0000
+++ 0036-app-testpmd-fix-flex-item-config-buffer-overflow.patch	2026-10-27 11:43:53.542060315 +0000
@@ -1 +1 @@
-From b8a6b1f18be70439431191a1d326d714f4d4b0d7 Mon Sep 17 00:00:00 2001
+From 366feda7764433809652f11b973be7b7dff3ac2c Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit b8a6b1f18be70439431191a1d326d714f4d4b0d7 ]
+
@@ -11 +12,0 @@
-Cc: stable at dpdk.org
@@ -19 +20 @@
-index af6c087feb..c0bbff7b45 100644
+index af6c087feba..c0bbff7b45f 100644