patch 'examples/ipsec-secgw: drop packets in poll mode' has been queued to stable release 24.11.7

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.7

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 07/05/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/da82d5363a6b7d0099a11bb2d6273c19523fd986

Thanks.

Luca Boccassi

---
>From da82d5363a6b7d0099a11bb2d6273c19523fd986 Mon Sep 17 00:00:00 2001
From: Rakesh Kudurumalla <rkudurumalla at marvell.com>
Date: Mon, 1 Jun 2026 09:59:46 +0530
Subject: [PATCH] examples/ipsec-secgw: drop packets in poll mode

[ upstream commit 3d3381be2c678823c4a391d95d9a251a4b6b2156 ]

During antireplay test packets are forwarded despite
errors in poll mode instead of dropping.
This patch fixes the same.

Fixes: dcbf9ad5fdf4 ("examples/ipsec-secgw: move fast path helper functions")

Signed-off-by: Rakesh Kudurumalla <rkudurumalla at marvell.com>
Acked-by: Akhil Goyal <gakhil at marvell.com>
---
 examples/ipsec-secgw/ipsec_worker.c | 4 ++--
 examples/ipsec-secgw/ipsec_worker.h | 4 +++-
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/examples/ipsec-secgw/ipsec_worker.c b/examples/ipsec-secgw/ipsec_worker.c
index 04609964cd..61b4126759 100644
--- a/examples/ipsec-secgw/ipsec_worker.c
+++ b/examples/ipsec-secgw/ipsec_worker.c
@@ -428,7 +428,7 @@ process_ipsec_ev_inbound(struct ipsec_ctx *ctx, struct route_table *rt,
 		if (pkt->ol_flags & RTE_MBUF_F_RX_SEC_OFFLOAD) {
 			if (unlikely(pkt->ol_flags &
 				     RTE_MBUF_F_RX_SEC_OFFLOAD_FAILED)) {
-				RTE_LOG(ERR, IPSEC,
+				RTE_LOG(DEBUG, IPSEC,
 					"Inbound security offload failed\n");
 				goto drop_pkt_and_exit;
 			}
@@ -446,7 +446,7 @@ process_ipsec_ev_inbound(struct ipsec_ctx *ctx, struct route_table *rt,
 		if (pkt->ol_flags & RTE_MBUF_F_RX_SEC_OFFLOAD) {
 			if (unlikely(pkt->ol_flags &
 				     RTE_MBUF_F_RX_SEC_OFFLOAD_FAILED)) {
-				RTE_LOG(ERR, IPSEC,
+				RTE_LOG(DEBUG, IPSEC,
 					"Inbound security offload failed\n");
 				goto drop_pkt_and_exit;
 			}
diff --git a/examples/ipsec-secgw/ipsec_worker.h b/examples/ipsec-secgw/ipsec_worker.h
index 8f96161293..d5b8618fc8 100644
--- a/examples/ipsec-secgw/ipsec_worker.h
+++ b/examples/ipsec-secgw/ipsec_worker.h
@@ -421,7 +421,9 @@ inbound_sp_sa(struct sp_ctx *sp, struct sa_ctx *sa, struct traffic_type *ip,
 		}
 
 		/* Only check SPI match for processed IPSec packets */
-		if (i < lim && ((m->ol_flags & RTE_MBUF_F_RX_SEC_OFFLOAD) == 0)) {
+		if (i < lim && ((m->ol_flags & (RTE_MBUF_F_RX_SEC_OFFLOAD |
+				 RTE_MBUF_F_RX_SEC_OFFLOAD_FAILED))) !=
+				 RTE_MBUF_F_RX_SEC_OFFLOAD) {
 			stats->discard++;
 			free_pkts(&m, 1);
 			continue;
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-07-03 12:55:47.025865222 +0100
+++ 0008-examples-ipsec-secgw-drop-packets-in-poll-mode.patch	2026-07-03 12:55:46.582571675 +0100
@@ -1 +1 @@
-From 3d3381be2c678823c4a391d95d9a251a4b6b2156 Mon Sep 17 00:00:00 2001
+From da82d5363a6b7d0099a11bb2d6273c19523fd986 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 3d3381be2c678823c4a391d95d9a251a4b6b2156 ]
+
@@ -11 +12,0 @@
-Cc: stable at dpdk.org
@@ -21 +22 @@
-index 612f78f2dc..1dd4696e6a 100644
+index 04609964cd..61b4126759 100644
@@ -43 +44 @@
-index 6db5951b9b..65d2cb9889 100644
+index 8f96161293..d5b8618fc8 100644