patch 'ethdev: fix out-of-bounds write in GENEVE option conversion' has been queued to stable release 24.11.7

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.7

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 07/05/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/bee536b2fcf482d49cb6aef26b52d1e6cf9dfb80

Thanks.

Luca Boccassi

---
>From bee536b2fcf482d49cb6aef26b52d1e6cf9dfb80 Mon Sep 17 00:00:00 2001
From: James Raphael Tiovalen <jamestiotio at gmail.com>
Date: Wed, 10 Jun 2026 19:33:33 +0800
Subject: [PATCH] ethdev: fix out-of-bounds write in GENEVE option conversion

[ upstream commit 0dd533ec89e5d260d61e2a62385880aa71a421ea ]

rte_flow_conv_item_spec() is documented to truncate output to the
caller-supplied buffer size. For RTE_FLOW_ITEM_TYPE_GENEVE_OPT, the
deep-copy of the variable-length option data was gated on `size > 0`
instead of `size >= off + tmp`, the form used by the sibling RAW
branch. A caller passing a buffer just large enough for the header
struct had adjacent memory clobbered by up to `option_len * 4` bytes of
option payload.

Align the GENEVE_OPT guard with the RAW one.

Fixes: 841a0445442d ("ethdev: fix GENEVE option item conversion")

Signed-off-by: James Raphael Tiovalen <jamestiotio at gmail.com>
---
 .mailmap              | 1 +
 lib/ethdev/rte_flow.c | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.mailmap b/.mailmap
index acecb58342..79593ba852 100644
--- a/.mailmap
+++ b/.mailmap
@@ -654,6 +654,7 @@ James Fox <jamesfox at xilinx.com>
 James Grant <j.grant at qub.ac.uk>
 James Hershaw <james.hershaw at corigine.com>
 James Poole <james.g.poole at intel.com>
+James Raphael Tiovalen <jamestiotio at gmail.com>
 Jamie Lavigne <lavignen at amazon.com>
 Jananee Parthasarathy <jananeex.m.parthasarathy at intel.com>
 Jan Beulich <jbeulich at suse.com>
diff --git a/lib/ethdev/rte_flow.c b/lib/ethdev/rte_flow.c
index 1b9d477af4..17f4ede91f 100644
--- a/lib/ethdev/rte_flow.c
+++ b/lib/ethdev/rte_flow.c
@@ -689,7 +689,7 @@ rte_flow_conv_item_spec(void *buf, const size_t size,
 		src.geneve_opt = data;
 		dst.geneve_opt = buf;
 		tmp = spec.geneve_opt ? (spec.geneve_opt->option_len << 2) : 0;
-		if (size > 0 && tmp > 0 && src.geneve_opt->data) {
+		if (size >= off + tmp && tmp > 0 && src.geneve_opt->data) {
 			deep_src = (void *)((uintptr_t)(dst.geneve_opt + 1));
 			dst.geneve_opt->data = rte_memcpy(deep_src,
 							  src.geneve_opt->data,
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-07-03 12:55:48.427942033 +0100
+++ 0046-ethdev-fix-out-of-bounds-write-in-GENEVE-option-conv.patch	2026-07-03 12:55:46.678574191 +0100
@@ -1 +1 @@
-From 0dd533ec89e5d260d61e2a62385880aa71a421ea Mon Sep 17 00:00:00 2001
+From bee536b2fcf482d49cb6aef26b52d1e6cf9dfb80 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 0dd533ec89e5d260d61e2a62385880aa71a421ea ]
+
@@ -17 +18,0 @@
-Cc: stable at dpdk.org
@@ -26 +27 @@
-index 4b5eb0c841..b6ba4a6253 100644
+index acecb58342..79593ba852 100644
@@ -29 +30 @@
-@@ -687,6 +687,7 @@ James Fox <jamesfox at xilinx.com>
+@@ -654,6 +654,7 @@ James Fox <jamesfox at xilinx.com>
@@ -34,0 +36 @@
+ Jananee Parthasarathy <jananeex.m.parthasarathy at intel.com>
@@ -36 +37,0 @@
- Jan Blunck <jblunck at infradead.org>
@@ -38 +39 @@
-index 24eb5a95b0..57ce610d6d 100644
+index 1b9d477af4..17f4ede91f 100644
@@ -41 +42 @@
-@@ -704,7 +704,7 @@ rte_flow_conv_item_spec(void *buf, const size_t size,
+@@ -689,7 +689,7 @@ rte_flow_conv_item_spec(void *buf, const size_t size,