patch 'ethdev: fix out-of-bounds write in GENEVE option conversion' has been queued to stable release 25.11.3

[Kevin Traynor]

Hi,

FYI, your patch has been queued to stable release 25.11.3

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 08/01/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/kevintraynor/dpdk-stable

This queued commit can be viewed at:
https://github.com/kevintraynor/dpdk-stable/commit/e0c9dff92f6452513890b22700cfd5f8207c1033

Thanks.

Kevin

---
>From e0c9dff92f6452513890b22700cfd5f8207c1033 Mon Sep 17 00:00:00 2001
From: James Raphael Tiovalen <jamestiotio at gmail.com>
Date: Wed, 10 Jun 2026 19:33:33 +0800
Subject: [PATCH] ethdev: fix out-of-bounds write in GENEVE option conversion

[ upstream commit 0dd533ec89e5d260d61e2a62385880aa71a421ea ]

rte_flow_conv_item_spec() is documented to truncate output to the
caller-supplied buffer size. For RTE_FLOW_ITEM_TYPE_GENEVE_OPT, the
deep-copy of the variable-length option data was gated on `size > 0`
instead of `size >= off + tmp`, the form used by the sibling RAW
branch. A caller passing a buffer just large enough for the header
struct had adjacent memory clobbered by up to `option_len * 4` bytes of
option payload.

Align the GENEVE_OPT guard with the RAW one.

Fixes: 841a0445442d ("ethdev: fix GENEVE option item conversion")

Signed-off-by: James Raphael Tiovalen <jamestiotio at gmail.com>
---
 .mailmap              | 1 +
 lib/ethdev/rte_flow.c | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.mailmap b/.mailmap
index b287bb073c..57a2044bfe 100644
--- a/.mailmap
+++ b/.mailmap
@@ -683,4 +683,5 @@ James Grant <j.grant at qub.ac.uk>
 James Hershaw <james.hershaw at corigine.com>
 James Poole <james.g.poole at intel.com>
+James Raphael Tiovalen <jamestiotio at gmail.com>
 Jamie Lavigne <lavignen at amazon.com>
 Jan Beulich <jbeulich at suse.com>
diff --git a/lib/ethdev/rte_flow.c b/lib/ethdev/rte_flow.c
index 7a51b667cf..89118953fb 100644
--- a/lib/ethdev/rte_flow.c
+++ b/lib/ethdev/rte_flow.c
@@ -702,5 +702,5 @@ rte_flow_conv_item_spec(void *buf, const size_t size,
 		dst.geneve_opt = buf;
 		tmp = spec.geneve_opt ? (spec.geneve_opt->option_len << 2) : 0;
-		if (size > 0 && tmp > 0 && src.geneve_opt->data) {
+		if (size >= off + tmp && tmp > 0 && src.geneve_opt->data) {
 			deep_src = (void *)((uintptr_t)(dst.geneve_opt + 1));
 			dst.geneve_opt->data = rte_memcpy(deep_src,
-- 
2.55.0

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-07-28 16:54:53.213906481 +0100
+++ 0083-ethdev-fix-out-of-bounds-write-in-GENEVE-option-conv.patch	2026-07-28 16:54:50.838729058 +0100
@@ -1 +1 @@
-From 0dd533ec89e5d260d61e2a62385880aa71a421ea Mon Sep 17 00:00:00 2001
+From e0c9dff92f6452513890b22700cfd5f8207c1033 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 0dd533ec89e5d260d61e2a62385880aa71a421ea ]
+
@@ -17 +18,0 @@
-Cc: stable at dpdk.org
@@ -26 +27 @@
-index 4b5eb0c841..b6ba4a6253 100644
+index b287bb073c..57a2044bfe 100644
@@ -29 +30 @@
-@@ -688,4 +688,5 @@ James Grant <j.grant at qub.ac.uk>
+@@ -683,4 +683,5 @@ James Grant <j.grant at qub.ac.uk>
@@ -36 +37 @@
-index 24eb5a95b0..57ce610d6d 100644
+index 7a51b667cf..89118953fb 100644
@@ -39 +40 @@
-@@ -705,5 +705,5 @@ rte_flow_conv_item_spec(void *buf, const size_t size,
+@@ -702,5 +702,5 @@ rte_flow_conv_item_spec(void *buf, const size_t size,