patch 'net/ixgbe: fix potential null dereference in IPsec flow' has been queued to stable release 25.11.1

[Kevin Traynor]

Hi,

FYI, your patch has been queued to stable release 25.11.1

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 03/02/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/kevintraynor/dpdk-stable

This queued commit can be viewed at:
https://github.com/kevintraynor/dpdk-stable/commit/90079b47ac5b4754ae0034b18df5c3d2533cca07

Thanks.

Kevin

---
>From 90079b47ac5b4754ae0034b18df5c3d2533cca07 Mon Sep 17 00:00:00 2001
From: Anatoly Burakov <anatoly.burakov at intel.com>
Date: Fri, 13 Feb 2026 09:10:06 +0000
Subject: [PATCH] net/ixgbe: fix potential null dereference in IPsec flow

[ upstream commit b2eb30b5c286bb454fc0fe6a041263f33e9717ce ]

Currently, IPsec flow parser will look for IPv4 flow item in the
pattern, and then pass it to IPsec SA flow function. However, we do not
check if the spec pointer is actually valid. Fix by adding the check.

Fixes: 9a0752f498d2 ("net/ixgbe: enable inline IPsec")

Signed-off-by: Anatoly Burakov <anatoly.burakov at intel.com>
Acked-by: Bruce Richardson <bruce.richardson at intel.com>
Acked-by: Radu Nicolau <radu.nicolau at intel.com>
---
 drivers/net/intel/ixgbe/ixgbe_flow.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/net/intel/ixgbe/ixgbe_flow.c b/drivers/net/intel/ixgbe/ixgbe_flow.c
index 81b983ce69..90a24806d2 100644
--- a/drivers/net/intel/ixgbe/ixgbe_flow.c
+++ b/drivers/net/intel/ixgbe/ixgbe_flow.c
@@ -252,4 +252,10 @@ cons_parse_ntuple_filter(const struct rte_flow_attr *attr,
 			item = next_no_void_pattern(pattern, item);
 		}
+		if (item->spec == NULL) {
+			rte_flow_error_set(error, EINVAL,
+					RTE_FLOW_ERROR_TYPE_ITEM_SPEC, item,
+					"NULL IP pattern.");
+			return -rte_errno;
+		}
 
 		filter->proto = IPPROTO_ESP;
-- 
2.53.0

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-02-26 10:16:51.981064650 +0000
+++ 0126-net-ixgbe-fix-potential-null-dereference-in-IPsec-fl.patch	2026-02-26 10:16:47.182460247 +0000
@@ -1 +1 @@
-From b2eb30b5c286bb454fc0fe6a041263f33e9717ce Mon Sep 17 00:00:00 2001
+From 90079b47ac5b4754ae0034b18df5c3d2533cca07 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit b2eb30b5c286bb454fc0fe6a041263f33e9717ce ]
+
@@ -11 +12,0 @@
-Cc: stable at dpdk.org