patch 'net/iavf: reject oversized frames in prep callback' has been queued to stable release 25.11.3

[Kevin Traynor]

Hi,

FYI, your patch has been queued to stable release 25.11.3

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 08/01/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/kevintraynor/dpdk-stable

This queued commit can be viewed at:
https://github.com/kevintraynor/dpdk-stable/commit/efe63a3d48d72a0a995a618337c8ffe8d5bfe7ad

Thanks.

Kevin

---
>From efe63a3d48d72a0a995a618337c8ffe8d5bfe7ad Mon Sep 17 00:00:00 2001
From: Ciara Loftus <ciara.loftus at intel.com>
Date: Tue, 9 Jun 2026 14:03:17 +0000
Subject: [PATCH] net/iavf: reject oversized frames in prep callback

[ upstream commit c7555250c8bd71af832be8cbd5179dea488bacc8 ]

Currently, only the segment count is checked for non-TSO packets. There
is no upper bound placed on the packet length, so packets larger than
`IAVF_FRAME_SIZE_MAX` pass the prepare callback unchallenged and are
submitted to the hardware. Sending such frames can trigger Malicious
Driver Detection (MDD) on the PF. Fix this by adding a packet length
size check on the non-TSO path.

Fixes: 19ee91c6bd9a ("net/iavf: check illegal packet sizes")

Signed-off-by: Ciara Loftus <ciara.loftus at intel.com>
Acked-by: Bruce Richardson <bruce.richardson at intel.com>
---
 drivers/net/intel/iavf/iavf_rxtx.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/intel/iavf/iavf_rxtx.c b/drivers/net/intel/iavf/iavf_rxtx.c
index fd940de03b..40ddd9c65a 100644
--- a/drivers/net/intel/iavf/iavf_rxtx.c
+++ b/drivers/net/intel/iavf/iavf_rxtx.c
@@ -3605,7 +3605,7 @@ iavf_prep_pkts(__rte_unused void *tx_queue, struct rte_mbuf **tx_pkts,
 		ol_flags = m->ol_flags;
 
-		/* Check condition for nb_segs > IAVF_TX_MAX_MTU_SEG. */
+		/* Validate segment count and packet length. */
 		if (!(ol_flags & (RTE_MBUF_F_TX_TCP_SEG | RTE_MBUF_F_TX_UDP_SEG))) {
-			if (m->nb_segs > IAVF_TX_MAX_MTU_SEG) {
+			if (m->nb_segs > IAVF_TX_MAX_MTU_SEG || m->pkt_len > IAVF_FRAME_SIZE_MAX) {
 				rte_errno = EINVAL;
 				return i;
-- 
2.55.0

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-07-28 16:54:52.658682614 +0100
+++ 0064-net-iavf-reject-oversized-frames-in-prep-callback.patch	2026-07-28 16:54:50.811728837 +0100
@@ -1 +1 @@
-From c7555250c8bd71af832be8cbd5179dea488bacc8 Mon Sep 17 00:00:00 2001
+From efe63a3d48d72a0a995a618337c8ffe8d5bfe7ad Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit c7555250c8bd71af832be8cbd5179dea488bacc8 ]
+
@@ -14 +15,0 @@
-Cc: stable at dpdk.org
@@ -23 +24 @@
-index decbc75142..a57af7faed 100644
+index fd940de03b..40ddd9c65a 100644
@@ -26 +27 @@
-@@ -3228,7 +3228,7 @@ iavf_prep_pkts(__rte_unused void *tx_queue, struct rte_mbuf **tx_pkts,
+@@ -3605,7 +3605,7 @@ iavf_prep_pkts(__rte_unused void *tx_queue, struct rte_mbuf **tx_pkts,