patch 'net/ixgbe: fix potential null dereference in IPsec flow' has been queued to stable release 24.11.5

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.5

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 02/22/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/996591e6a5c4113e8f42144285ce758a6aa47701

Thanks.

Luca Boccassi

---
>From 996591e6a5c4113e8f42144285ce758a6aa47701 Mon Sep 17 00:00:00 2001
From: Anatoly Burakov <anatoly.burakov at intel.com>
Date: Fri, 13 Feb 2026 09:10:06 +0000
Subject: [PATCH] net/ixgbe: fix potential null dereference in IPsec flow

[ upstream commit b2eb30b5c286bb454fc0fe6a041263f33e9717ce ]

Currently, IPsec flow parser will look for IPv4 flow item in the
pattern, and then pass it to IPsec SA flow function. However, we do not
check if the spec pointer is actually valid. Fix by adding the check.

Fixes: 9a0752f498d2 ("net/ixgbe: enable inline IPsec")

Signed-off-by: Anatoly Burakov <anatoly.burakov at intel.com>
Acked-by: Bruce Richardson <bruce.richardson at intel.com>
Acked-by: Radu Nicolau <radu.nicolau at intel.com>
---
 drivers/net/ixgbe/ixgbe_flow.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/net/ixgbe/ixgbe_flow.c b/drivers/net/ixgbe/ixgbe_flow.c
index 2b1e56f3c4..1bdf3d66a8 100644
--- a/drivers/net/ixgbe/ixgbe_flow.c
+++ b/drivers/net/ixgbe/ixgbe_flow.c
@@ -251,6 +251,12 @@ cons_parse_ntuple_filter(const struct rte_flow_attr *attr,
 			}
 			item = next_no_void_pattern(pattern, item);
 		}
+		if (item->spec == NULL) {
+			rte_flow_error_set(error, EINVAL,
+					RTE_FLOW_ERROR_TYPE_ITEM_SPEC, item,
+					"NULL IP pattern.");
+			return -rte_errno;
+		}
 
 		filter->proto = IPPROTO_ESP;
 		return ixgbe_crypto_add_ingress_sa_from_flow(conf, item->spec,
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-02-20 14:55:47.016579762 +0000
+++ 0099-net-ixgbe-fix-potential-null-dereference-in-IPsec-fl.patch	2026-02-20 14:55:43.352193583 +0000
@@ -1 +1 @@
-From b2eb30b5c286bb454fc0fe6a041263f33e9717ce Mon Sep 17 00:00:00 2001
+From 996591e6a5c4113e8f42144285ce758a6aa47701 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit b2eb30b5c286bb454fc0fe6a041263f33e9717ce ]
+
@@ -11 +12,0 @@
-Cc: stable at dpdk.org
@@ -17 +18 @@
- drivers/net/intel/ixgbe/ixgbe_flow.c | 6 ++++++
+ drivers/net/ixgbe/ixgbe_flow.c | 6 ++++++
@@ -20,4 +21,4 @@
-diff --git a/drivers/net/intel/ixgbe/ixgbe_flow.c b/drivers/net/intel/ixgbe/ixgbe_flow.c
-index 81b983ce69..90a24806d2 100644
---- a/drivers/net/intel/ixgbe/ixgbe_flow.c
-+++ b/drivers/net/intel/ixgbe/ixgbe_flow.c
+diff --git a/drivers/net/ixgbe/ixgbe_flow.c b/drivers/net/ixgbe/ixgbe_flow.c
+index 2b1e56f3c4..1bdf3d66a8 100644
+--- a/drivers/net/ixgbe/ixgbe_flow.c
++++ b/drivers/net/ixgbe/ixgbe_flow.c