patch 'examples/ipsec-secgw: drop packets in poll mode' has been queued to stable release 25.11.3

[Kevin Traynor]

Hi,

FYI, your patch has been queued to stable release 25.11.3

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 08/01/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/kevintraynor/dpdk-stable

This queued commit can be viewed at:
https://github.com/kevintraynor/dpdk-stable/commit/8c002f5ba0d114659315c18f0db7d7bc5a428c77

Thanks.

Kevin

---
>From 8c002f5ba0d114659315c18f0db7d7bc5a428c77 Mon Sep 17 00:00:00 2001
From: Rakesh Kudurumalla <rkudurumalla at marvell.com>
Date: Mon, 1 Jun 2026 09:59:46 +0530
Subject: [PATCH] examples/ipsec-secgw: drop packets in poll mode

[ upstream commit 3d3381be2c678823c4a391d95d9a251a4b6b2156 ]

During antireplay test packets are forwarded despite
errors in poll mode instead of dropping.
This patch fixes the same.

Fixes: dcbf9ad5fdf4 ("examples/ipsec-secgw: move fast path helper functions")

Signed-off-by: Rakesh Kudurumalla <rkudurumalla at marvell.com>
Acked-by: Akhil Goyal <gakhil at marvell.com>
---
 examples/ipsec-secgw/ipsec_worker.c | 4 ++--
 examples/ipsec-secgw/ipsec_worker.h | 4 +++-
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/examples/ipsec-secgw/ipsec_worker.c b/examples/ipsec-secgw/ipsec_worker.c
index 04609964cd..61b4126759 100644
--- a/examples/ipsec-secgw/ipsec_worker.c
+++ b/examples/ipsec-secgw/ipsec_worker.c
@@ -429,5 +429,5 @@ process_ipsec_ev_inbound(struct ipsec_ctx *ctx, struct route_table *rt,
 			if (unlikely(pkt->ol_flags &
 				     RTE_MBUF_F_RX_SEC_OFFLOAD_FAILED)) {
-				RTE_LOG(ERR, IPSEC,
+				RTE_LOG(DEBUG, IPSEC,
 					"Inbound security offload failed\n");
 				goto drop_pkt_and_exit;
@@ -447,5 +447,5 @@ process_ipsec_ev_inbound(struct ipsec_ctx *ctx, struct route_table *rt,
 			if (unlikely(pkt->ol_flags &
 				     RTE_MBUF_F_RX_SEC_OFFLOAD_FAILED)) {
-				RTE_LOG(ERR, IPSEC,
+				RTE_LOG(DEBUG, IPSEC,
 					"Inbound security offload failed\n");
 				goto drop_pkt_and_exit;
diff --git a/examples/ipsec-secgw/ipsec_worker.h b/examples/ipsec-secgw/ipsec_worker.h
index 8f96161293..d5b8618fc8 100644
--- a/examples/ipsec-secgw/ipsec_worker.h
+++ b/examples/ipsec-secgw/ipsec_worker.h
@@ -422,5 +422,7 @@ inbound_sp_sa(struct sp_ctx *sp, struct sa_ctx *sa, struct traffic_type *ip,
 
 		/* Only check SPI match for processed IPSec packets */
-		if (i < lim && ((m->ol_flags & RTE_MBUF_F_RX_SEC_OFFLOAD) == 0)) {
+		if (i < lim && ((m->ol_flags & (RTE_MBUF_F_RX_SEC_OFFLOAD |
+				 RTE_MBUF_F_RX_SEC_OFFLOAD_FAILED))) !=
+				 RTE_MBUF_F_RX_SEC_OFFLOAD) {
 			stats->discard++;
 			free_pkts(&m, 1);
-- 
2.55.0

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-07-28 16:54:51.973126421 +0100
+++ 0040-examples-ipsec-secgw-drop-packets-in-poll-mode.patch	2026-07-28 16:54:50.778514484 +0100
@@ -1 +1 @@
-From 3d3381be2c678823c4a391d95d9a251a4b6b2156 Mon Sep 17 00:00:00 2001
+From 8c002f5ba0d114659315c18f0db7d7bc5a428c77 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 3d3381be2c678823c4a391d95d9a251a4b6b2156 ]
+
@@ -11 +12,0 @@
-Cc: stable at dpdk.org
@@ -21 +22 @@
-index 612f78f2dc..1dd4696e6a 100644
+index 04609964cd..61b4126759 100644
@@ -39 +40 @@
-index 6db5951b9b..65d2cb9889 100644
+index 8f96161293..d5b8618fc8 100644