app/testpmd: fix flex item link parsing

PATCH Superseded Maayan Kashani 2 participants 5 messages Nov 13, 2025 – Nov 17, 2025

Share & tools

Maayan Kashani

author

2025-11-13 20:17 UTC #0 lore raw

PATCH 1/1 app/testpmd: fix flex item link parsing

The flex_link_item_parse function was using FLEX_MAX_FLOW_PATTERN_LENGTH for all memcpy operations regardless of the actual flow item type. This could lead to copying incorrect amounts of data.

This patch adds a switch statement to determine the correct size based on the actual flow item type (IPv4, IPv6, UDP, TCP) and uses that size for the memcpy operations on spec, mask, and last fields.

Also adds validation to reject unsupported item types.

Fixes 59f3a8acbcdb ("app/testpmd: add flex item commands")

Cc [email protected]

Signed-off-by Maayan Kashani <[email protected]>

---
 app/test-pmd/cmd_flex_item.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

app/test-pmd/cmd_flex_item.c +7 -3

index e6e1cefeb3d..ec19ab63e75 100644
@@ -134,6 +134,7 @@ flex_link_item_parse(const char *src, struct rte_flow_item *item)
 	struct rte_flow_attr *attr;
 	struct rte_flow_item *pattern;
 	struct rte_flow_action *actions;
+	size_t sz = 0;
 
 	sprintf(flow_rule,
 		"flow create 0 pattern %s / end actions drop / end", src);

@@ -143,21 +144,24 @@ flex_link_item_parse(const char *src, struct rte_flow_item *item)
 	if (ret)
 		return ret;
 	item->type = pattern->type;
+	ret = rte_flow_conv(RTE_FLOW_CONV_OP_ITEM_MASK, NULL, 0, item, NULL);
+	if (ret > 0)
+		sz = ret;
 	if (pattern->spec) {
 		ptr = (void *)(uintptr_t)item->spec;
-		memcpy(ptr, pattern->spec, FLEX_MAX_FLOW_PATTERN_LENGTH);
+		memcpy(ptr, pattern->spec, sz);
 	} else {
 		item->spec = NULL;
 	}
 	if (pattern->mask) {
 		ptr = (void *)(uintptr_t)item->mask;
-		memcpy(ptr, pattern->mask, FLEX_MAX_FLOW_PATTERN_LENGTH);
+		memcpy(ptr, pattern->mask, sz);
 	} else {
 		item->mask = NULL;
 	}
 	if (pattern->last) {
 		ptr = (void *)(uintptr_t)item->last;
-		memcpy(ptr, pattern->last, FLEX_MAX_FLOW_PATTERN_LENGTH);
+		memcpy(ptr, pattern->last, sz);
 	} else {
 		item->last = NULL;
 	}

Signature · 1 line

2.21.0

Stephen Hemminger

2025-11-13 22:38 UTC #1 lore raw

Quoted 31 lines · On Thu, 13 Nov 2025 22:17:25 +0200 Maayan Kashani <[email protected]> wrote:

The flex_link_item_parse function was using FLEX_MAX_FLOW_PATTERN_LENGTH for all memcpy operations regardless of the actual flow item type. This could lead to copying incorrect amounts of data.
This patch adds a switch statement to determine the correct size based on the actual flow item type (IPv4, IPv6, UDP, TCP) and uses that size for the memcpy operations on spec, mask, and last fields.
Also adds validation to reject unsupported item types.
Fixes 59f3a8acbcdb ("app/testpmd: add flex item commands")
Cc [email protected]
Signed-off-by Maayan Kashani <[email protected]>
---
 app/test-pmd/cmd_flex_item.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)
app/test-pmd/cmd_flex_item.c +1 -0
index e6e1cefeb3d..ec19ab63e75 100644
@@ -134,6 +134,7 @@ flex_link_item_parse(const char *src, struct rte_flow_item *item)
 	struct rte_flow_attr *attr;
 	struct rte_flow_item *pattern;
 	struct rte_flow_action *actions;
+	size_t sz = 0;
 
 	sprintf(flow_rule,
 		"flow create 0 pattern %s / end actions drop / end", src);

app/test-pmd/cmd_flex_item.c flex_link_item_parse(const char *src, struct rte_flow_item *item) · line 149

Quoted 6 lines

app/test-pmd/cmd_flex_item.c +3 -0

@@ -143,21 +144,24 @@ flex_link_item_parse(const char *src, struct rte_flow_item *item)
 	if (ret)
 		return ret;
 	item->type = pattern->type;
+	ret = rte_flow_conv(RTE_FLOW_CONV_OP_ITEM_MASK, NULL, 0, item, NULL);
+	if (ret > 0)
+		sz = ret;

You don't really need a temporary variable sz, can't you just use the return value directly or are you concerned about signed/unsigned mismatch. If concerned about signed/unsigned mismatch warnings then would need cast on the assignment to sz.

Maayan Kashani

author

2025-11-16 08:11 UTC #2 lore raw

Thanks Stephen,
I'll send v2 with required change.

Regards,
Maayan Kashani

Quoted 63 lines

-----Original Message-----
From: Stephen Hemminger <[email protected]>
Sent: Friday, 14 November 2025 0:38
To: Maayan Kashani <[email protected]>
Cc: [email protected]; Raslan Darawsheh <[email protected]>; [email protected]; Aman Singh <[email protected]>; Slava Ovsiienko <[email protected]>; Gregory Etelson <[email protected]>
Subject: Re: [PATCH] app/testpmd: fix flex item link parsing
External email: Use caution opening links or attachments
Quoted 2 lines · On Thu, 13 Nov 2025 22:17:25 +0200 Maayan Kashani <[email protected]> wrote:
The flex_link_item_parse function was using FLEX_MAX_FLOW_PATTERN_LENGTH for all memcpy operations regardless
of
Quoted 1 line
the actual flow item type. This could lead to copying incorrect amounts of
data.
app/test-pmd/cmd_flex_item.c flex_link_item_parse(const char *src, struct
Quoted 20 lines
This patch adds a switch statement to determine the correct size based on the actual flow item type (IPv4, IPv6, UDP, TCP) and uses that size for the memcpy operations on spec, mask, and last fields.
Also adds validation to reject unsupported item types.
Fixes 59f3a8acbcdb ("app/testpmd: add flex item commands")
Cc [email protected]
Signed-off-by Maayan Kashani <[email protected]>
---
 app/test-pmd/cmd_flex_item.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)
(quoted diff) +0 -0
b/app/test-pmd/cmd_flex_item.c index e6e1cefeb3d..ec19ab63e75 100644
app/test-pmd/cmd_flex_item.c +0 -0
@@ -134,6 +134,7 @@ flex_link_item_parse(const char *src, struct
rte_flow_item *item)
Quoted 8 lines
app/test-pmd/cmd_flex_item.c +1 -0
      struct rte_flow_attr *attr;
      struct rte_flow_item *pattern;
      struct rte_flow_action *actions;
+     size_t sz = 0;
 
      sprintf(flow_rule,
              "flow create 0 pattern %s / end actions drop / end",
src); @@ -143,21 +144,24 @@ flex_link_item_parse(const char *src, struct
rte_flow_item *item)
Quoted 4 lines
      if (ret)
              return ret;
      item->type = pattern->type;
+ ret = rte_flow_conv(RTE_FLOW_CONV_OP_ITEM_MASK, NULL, 0, item,
NULL);
app/test-pmd/cmd_flex_item.c flex_link_item_parse(const char *src, struct rte_flow_item *item) · line 149
Quoted 2 lines
app/test-pmd/cmd_flex_item.c +2 -0
+     if (ret > 0)
+             sz = ret;
You don't really need a temporary variable sz, can't you just use the return value directly or are you concerned about signed/unsigned mismatch. If concerned about signed/unsigned mismatch warnings then would need cast on the assignment to sz.

Maayan Kashani

author

2025-11-16 12:15 UTC #3 lore raw

PATCH v2 1/1 app/testpmd: fix flex item link parsing

In reply to Maayan Kashani

The flex_link_item_parse function was using FLEX_MAX_FLOW_PATTERN_LENGTH for all memcpy operations regardless of the actual flow item type. This could lead to copying incorrect amounts of data.

This patch adds a switch statement to determine the correct size based on the actual flow item type (IPv4, IPv6, UDP, TCP) and uses that size for the memcpy operations on spec, mask, and last fields.

Also adds validation to reject unsupported item types.

Fixes 59f3a8acbcdb ("app/testpmd: add flex item commands")

Cc [email protected]

Signed-off-by Maayan Kashani <[email protected]>

---
 app/test-pmd/cmd_flex_item.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

app/test-pmd/cmd_flex_item.c +7 -6

index e6e1cefeb3d..af6c087feba 100644
@@ -143,21 +143,22 @@ flex_link_item_parse(const char *src, struct rte_flow_item *item)
 	if (ret)
 		return ret;
 	item->type = pattern->type;
-	if (pattern->spec) {
+	ret = rte_flow_conv(RTE_FLOW_CONV_OP_ITEM_MASK, NULL, 0, item, NULL);
+	if ((ret > 0) && pattern->spec) {
 		ptr = (void *)(uintptr_t)item->spec;
-		memcpy(ptr, pattern->spec, FLEX_MAX_FLOW_PATTERN_LENGTH);
+		memcpy(ptr, pattern->spec, ret);
 	} else {
 		item->spec = NULL;
 	}
-	if (pattern->mask) {
+	if ((ret > 0) && pattern->mask) {
 		ptr = (void *)(uintptr_t)item->mask;
-		memcpy(ptr, pattern->mask, FLEX_MAX_FLOW_PATTERN_LENGTH);
+		memcpy(ptr, pattern->mask, ret);
 	} else {
 		item->mask = NULL;
 	}
-	if (pattern->last) {
+	if ((ret > 0) && pattern->last) {
 		ptr = (void *)(uintptr_t)item->last;
-		memcpy(ptr, pattern->last, FLEX_MAX_FLOW_PATTERN_LENGTH);
+		memcpy(ptr, pattern->last, ret);
 	} else {
 		item->last = NULL;
 	}

Signature · 1 line

2.21.0

Stephen Hemminger

Applied

2025-11-17 18:20 UTC #4 lore raw

Quoted 8 lines · On Sun, 16 Nov 2025 14:14:37 +0200 Maayan Kashani <[email protected]> wrote:

The flex_link_item_parse function was using FLEX_MAX_FLOW_PATTERN_LENGTH for all memcpy operations regardless of the actual flow item type. This could lead to copying incorrect amounts of data.
This patch adds a switch statement to determine the correct size based on the actual flow item type (IPv4, IPv6, UDP, TCP) and uses that size for the memcpy operations on spec, mask, and last fields.

Quoted 6 lines

Also adds validation to reject unsupported item types.
Fixes 59f3a8acbcdb ("app/testpmd: add flex item commands")
Cc [email protected]
Signed-off-by Maayan Kashani <[email protected]>

Queued to next-net