patch 'net/i40e: fix flexible payload filter' has been queued to stable release 24.11.7

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.7

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 07/15/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/4a438493ad6d81964928d2bc38fd4c7ce4f5ba5f

Thanks.

Luca Boccassi

---
>From 4a438493ad6d81964928d2bc38fd4c7ce4f5ba5f Mon Sep 17 00:00:00 2001
From: Sandeep Penigalapati <sandeep.penigalapati at intel.com>
Date: Tue, 7 Jul 2026 20:20:45 -0400
Subject: [PATCH] net/i40e: fix flexible payload filter

[ upstream commit f3c828e13f69f03d523ea8938780411392207161 ]

This fixes two issues in the i40e Flow Director flexible payload path.

The bitmask array bound was checked after the write to
bitmask[nb_bitmask], allowing a one-slot out-of-bounds write when the
number of partial-mask words exceeds I40E_FDIR_BITMASK_NUM_WORD. Move
the check before the write and use '>=' so the array is never indexed
out of bounds.

In addition, i40e_flow_set_fdir_flex_pit() programs the global GLQF_ORT
register, which is shared by all PFs on the NIC. It was called before
the flex mask was validated, so a rule that is later rejected still left
the global register modified, affecting other PFs. Validate the flex
mask first and only touch the hardware registers once it has passed.

Fixes: 6ced3dd72f5f ("net/i40e: support flexible payload parsing for FDIR")

Signed-off-by: Sandeep Penigalapati <sandeep.penigalapati at intel.com>
Acked-by: Bruce Richardson <bruce.richardson at intel.com>
---
 drivers/net/i40e/i40e_fdir.c | 23 +++++++++++++++--------
 1 file changed, 15 insertions(+), 8 deletions(-)

diff --git a/drivers/net/i40e/i40e_fdir.c b/drivers/net/i40e/i40e_fdir.c
index 47f79ecf11..f66d6934a9 100644
--- a/drivers/net/i40e/i40e_fdir.c
+++ b/drivers/net/i40e/i40e_fdir.c
@@ -1232,12 +1232,12 @@ i40e_flow_store_flex_mask(struct i40e_pf *pf,
 			flex_mask.word_mask |=
 				I40E_FLEX_WORD_MASK(i / sizeof(uint16_t));
 			if (mask_tmp != UINT16_MAX) {
+				if (nb_bitmask >= I40E_FDIR_BITMASK_NUM_WORD)
+					return -1;
 				flex_mask.bitmask[nb_bitmask].mask = ~mask_tmp;
 				flex_mask.bitmask[nb_bitmask].offset =
 					i / sizeof(uint16_t);
 				nb_bitmask++;
-				if (nb_bitmask > I40E_FDIR_BITMASK_NUM_WORD)
-					return -1;
 			}
 		}
 	}
@@ -1491,15 +1491,17 @@ i40e_flow_add_del_fdir_filter(struct rte_eth_dev *dev,
 				}
 			}
 
-			if (cfg_flex_pit)
-				i40e_flow_set_fdir_flex_pit(pf, layer_idx,
-						filter->input.flow_ext.raw_id);
-
 			/* Store flex mask to SW */
 			for (i = 0; i < I40E_FDIR_MAX_FLEX_LEN; i++)
 				flex_mask[i] =
 					filter->input.flow_ext.flex_mask[i];
 
+			/* Validate the flex mask before writing any hardware
+			 * register. i40e_flow_set_fdir_flex_pit() below programs
+			 * the global GLQF_ORT register, which is shared by all
+			 * PFs on the NIC, so it must not be touched for a rule
+			 * that is going to be rejected.
+			 */
 			ret = i40e_flow_store_flex_mask(pf, pctype, flex_mask);
 			if (ret == -1) {
 				PMD_DRV_LOG(ERR, "Exceed maximal"
@@ -1509,9 +1511,14 @@ i40e_flow_add_del_fdir_filter(struct rte_eth_dev *dev,
 				PMD_DRV_LOG(ERR, "Conflict with the"
 					    " first flexible rule");
 				return -EINVAL;
-			} else if (ret == 0) {
+			}
+
+			if (cfg_flex_pit)
+				i40e_flow_set_fdir_flex_pit(pf, layer_idx,
+						filter->input.flow_ext.raw_id);
+
+			if (ret == 0)
 				i40e_flow_set_fdir_flex_msk(pf, pctype);
-			}
 		}
 
 		ret = i40e_sw_fdir_filter_insert(pf, &check_filter);
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-07-13 18:17:06.102945831 +0100
+++ 0014-net-i40e-fix-flexible-payload-filter.patch	2026-07-13 18:17:05.582282980 +0100
@@ -1 +1 @@
-From f3c828e13f69f03d523ea8938780411392207161 Mon Sep 17 00:00:00 2001
+From 4a438493ad6d81964928d2bc38fd4c7ce4f5ba5f Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit f3c828e13f69f03d523ea8938780411392207161 ]
+
@@ -21 +22,0 @@
-Cc: stable at dpdk.org
@@ -26 +27 @@
- drivers/net/intel/i40e/i40e_fdir.c | 23 +++++++++++++++--------
+ drivers/net/i40e/i40e_fdir.c | 23 +++++++++++++++--------
@@ -29,5 +30,5 @@
-diff --git a/drivers/net/intel/i40e/i40e_fdir.c b/drivers/net/intel/i40e/i40e_fdir.c
-index ad256a5a11..8a233f8a97 100644
---- a/drivers/net/intel/i40e/i40e_fdir.c
-+++ b/drivers/net/intel/i40e/i40e_fdir.c
-@@ -1230,12 +1230,12 @@ i40e_flow_store_flex_mask(struct i40e_pf *pf,
+diff --git a/drivers/net/i40e/i40e_fdir.c b/drivers/net/i40e/i40e_fdir.c
+index 47f79ecf11..f66d6934a9 100644
+--- a/drivers/net/i40e/i40e_fdir.c
++++ b/drivers/net/i40e/i40e_fdir.c
+@@ -1232,12 +1232,12 @@ i40e_flow_store_flex_mask(struct i40e_pf *pf,
@@ -48 +49 @@
-@@ -1488,15 +1488,17 @@ i40e_flow_add_del_fdir_filter(struct rte_eth_dev *dev,
+@@ -1491,15 +1491,17 @@ i40e_flow_add_del_fdir_filter(struct rte_eth_dev *dev,
@@ -70 +71 @@
-@@ -1506,9 +1508,14 @@ i40e_flow_add_del_fdir_filter(struct rte_eth_dev *dev,
+@@ -1509,9 +1511,14 @@ i40e_flow_add_del_fdir_filter(struct rte_eth_dev *dev,