patch 'net/ixgbe: fix potential null dereference in IPsec flow' has been queued to stable release 23.11.7

[Shani Peretz]

Hi,

FYI, your patch has been queued to stable release 23.11.7

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 04/05/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/shanipr/dpdk-stable

This queued commit can be viewed at:
https://github.com/shanipr/dpdk-stable/commit/35883d3b08bcaa8f3708ec704c1db957c83bd38a

Thanks.

Shani

---
>From 35883d3b08bcaa8f3708ec704c1db957c83bd38a Mon Sep 17 00:00:00 2001
From: Anatoly Burakov <anatoly.burakov at intel.com>
Date: Fri, 13 Feb 2026 09:10:06 +0000
Subject: [PATCH] net/ixgbe: fix potential null dereference in IPsec flow

[ upstream commit b2eb30b5c286bb454fc0fe6a041263f33e9717ce ]

Currently, IPsec flow parser will look for IPv4 flow item in the
pattern, and then pass it to IPsec SA flow function. However, we do not
check if the spec pointer is actually valid. Fix by adding the check.

Fixes: 9a0752f498d2 ("net/ixgbe: enable inline IPsec")

Signed-off-by: Anatoly Burakov <anatoly.burakov at intel.com>
Acked-by: Bruce Richardson <bruce.richardson at intel.com>
Acked-by: Radu Nicolau <radu.nicolau at intel.com>
---
 drivers/net/ixgbe/ixgbe_flow.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/net/ixgbe/ixgbe_flow.c b/drivers/net/ixgbe/ixgbe_flow.c
index 3dc2908f5f..222529327a 100644
--- a/drivers/net/ixgbe/ixgbe_flow.c
+++ b/drivers/net/ixgbe/ixgbe_flow.c
@@ -251,6 +251,12 @@ cons_parse_ntuple_filter(const struct rte_flow_attr *attr,
 			}
 			item = next_no_void_pattern(pattern, item);
 		}
+		if (item->spec == NULL) {
+			rte_flow_error_set(error, EINVAL,
+					RTE_FLOW_ERROR_TYPE_ITEM_SPEC, item,
+					"NULL IP pattern.");
+			return -rte_errno;
+		}
 
 		filter->proto = IPPROTO_ESP;
 		return ixgbe_crypto_add_ingress_sa_from_flow(conf, item->spec,
-- 
2.43.0

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-03-31 00:32:37.080200971 +0300
+++ 0092-net-ixgbe-fix-potential-null-dereference-in-IPsec-fl.patch	2026-03-31 00:32:29.708215000 +0300
@@ -1 +1 @@
-From b2eb30b5c286bb454fc0fe6a041263f33e9717ce Mon Sep 17 00:00:00 2001
+From 35883d3b08bcaa8f3708ec704c1db957c83bd38a Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit b2eb30b5c286bb454fc0fe6a041263f33e9717ce ]
+
@@ -11 +12,0 @@
-Cc: stable at dpdk.org
@@ -17 +18 @@
- drivers/net/intel/ixgbe/ixgbe_flow.c | 6 ++++++
+ drivers/net/ixgbe/ixgbe_flow.c | 6 ++++++
@@ -20,4 +21,4 @@
-diff --git a/drivers/net/intel/ixgbe/ixgbe_flow.c b/drivers/net/intel/ixgbe/ixgbe_flow.c
-index 81b983ce69..90a24806d2 100644
---- a/drivers/net/intel/ixgbe/ixgbe_flow.c
-+++ b/drivers/net/intel/ixgbe/ixgbe_flow.c
+diff --git a/drivers/net/ixgbe/ixgbe_flow.c b/drivers/net/ixgbe/ixgbe_flow.c
+index 3dc2908f5f..222529327a 100644
+--- a/drivers/net/ixgbe/ixgbe_flow.c
++++ b/drivers/net/ixgbe/ixgbe_flow.c