patch 'net/iavf: fix leak of IPsec crypto capabilities array' has been queued to stable release 24.11.7

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.7

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 07/15/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/650bbb25de39ff128ec877d0a5bd5a07200ec778

Thanks.

Luca Boccassi

---
>From 650bbb25de39ff128ec877d0a5bd5a07200ec778 Mon Sep 17 00:00:00 2001
From: Bruce Richardson <bruce.richardson at intel.com>
Date: Fri, 10 Jul 2026 11:34:03 +0100
Subject: [PATCH] net/iavf: fix leak of IPsec crypto capabilities array

[ upstream commit 16c59ff5b96aa473440ed85dd3a136fbcf2aa186 ]

The security context setup allocates a crypto capabilities array and
stores it in iavf_sctx->crypto_capabilities. However, the security
context destroy path frees iavf_sctx and sctx directly, without first
freeing that array.

Fix this by freeing iavf_sctx->crypto_capabilities in
iavf_security_ctx_destroy() before freeing the security context itself.

Fixes: 6bc987ecb860 ("net/iavf: support IPsec inline crypto")

Signed-off-by: Bruce Richardson <bruce.richardson at intel.com>
Acked-by: Ciara Loftus <ciara.loftus at intel.com>
---
 drivers/net/iavf/iavf_ipsec_crypto.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/iavf/iavf_ipsec_crypto.c b/drivers/net/iavf/iavf_ipsec_crypto.c
index e2910e61c7..bf9e5de1df 100644
--- a/drivers/net/iavf/iavf_ipsec_crypto.c
+++ b/drivers/net/iavf/iavf_ipsec_crypto.c
@@ -1574,6 +1574,8 @@ iavf_security_ctx_destroy(struct iavf_adapter *adapter)
 		return -ENODEV;
 
 	/* free and reset security data structures */
+	rte_free(iavf_sctx->crypto_capabilities);
+	iavf_sctx->crypto_capabilities = NULL;
 	rte_free(iavf_sctx);
 	rte_free(sctx);
 
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-07-13 18:17:06.316027598 +0100
+++ 0020-net-iavf-fix-leak-of-IPsec-crypto-capabilities-array.patch	2026-07-13 18:17:05.590283127 +0100
@@ -1 +1 @@
-From 16c59ff5b96aa473440ed85dd3a136fbcf2aa186 Mon Sep 17 00:00:00 2001
+From 650bbb25de39ff128ec877d0a5bd5a07200ec778 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 16c59ff5b96aa473440ed85dd3a136fbcf2aa186 ]
+
@@ -15 +16,0 @@
-Cc: stable at dpdk.org
@@ -20 +21 @@
- drivers/net/intel/iavf/iavf_ipsec_crypto.c | 2 ++
+ drivers/net/iavf/iavf_ipsec_crypto.c | 2 ++
@@ -23,5 +24,5 @@
-diff --git a/drivers/net/intel/iavf/iavf_ipsec_crypto.c b/drivers/net/intel/iavf/iavf_ipsec_crypto.c
-index b2e08da0aa..9c8f694de5 100644
---- a/drivers/net/intel/iavf/iavf_ipsec_crypto.c
-+++ b/drivers/net/intel/iavf/iavf_ipsec_crypto.c
-@@ -1572,6 +1572,8 @@ iavf_security_ctx_destroy(struct iavf_adapter *adapter)
+diff --git a/drivers/net/iavf/iavf_ipsec_crypto.c b/drivers/net/iavf/iavf_ipsec_crypto.c
+index e2910e61c7..bf9e5de1df 100644
+--- a/drivers/net/iavf/iavf_ipsec_crypto.c
++++ b/drivers/net/iavf/iavf_ipsec_crypto.c
+@@ -1574,6 +1574,8 @@ iavf_security_ctx_destroy(struct iavf_adapter *adapter)