patch 'net/ixgbe: fix L4 protocol parsing for ntuple' has been queued to stable release 24.11.9

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.9

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 11/07/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/a17c45d2fdfe8ac7d65aaa0bda6c5be184c36889

Thanks.

Luca Boccassi

---
>From a17c45d2fdfe8ac7d65aaa0bda6c5be184c36889 Mon Sep 17 00:00:00 2001
From: Anatoly Burakov <anatoly.burakov at intel.com>
Date: Tue, 13 Oct 2026 13:03:10 +0100
Subject: [PATCH] net/ixgbe: fix L4 protocol parsing for ntuple

[ upstream commit 1558685a98f3e15012aa95db9e91921b6d400d4c ]

Currently, when parsing ntuple flows, we may hit an empty L4 protocol
item (i.e. one that does not have a mask or spec), in which case we just
skip to the end. However, we do not set a protocol mask, which means we
will not be matching L4 flows even though the flow structure implies
that we should.

Fix it by setting up match-by-protocol when we have an empty L4 flow.

Additionally, there's a separate issue with how empty L4 protocol items
are handled in that once we see one, we do not check whether there's
anything else past it, and instead go straight to exit. This means that
we might have any other flow item after L4 (e.g. ipv4 / tcp / gtp) and
this will be silently accepted. Fix by enforcing that last item is END.

Fixes: 46ea969177f3 ("net/ixgbe: add ntuple support to flow parser")

Signed-off-by: Anatoly Burakov <anatoly.burakov at intel.com>
Acked-by: Vladimir Medvedkin <vladimir.medvedkin at intel.com>
---
 drivers/net/ixgbe/ixgbe_flow.c | 27 ++++++++++++++++++++++++---
 1 file changed, 24 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ixgbe/ixgbe_flow.c b/drivers/net/ixgbe/ixgbe_flow.c
index f8dfb432f44..01a6811f858 100644
--- a/drivers/net/ixgbe/ixgbe_flow.c
+++ b/drivers/net/ixgbe/ixgbe_flow.c
@@ -402,9 +402,29 @@ cons_parse_ntuple_filter(const struct rte_flow_attr *attr,
 		return -rte_errno;
 	}
 
-	if ((item->type != RTE_FLOW_ITEM_TYPE_END) &&
-		(!item->spec && !item->mask)) {
-		goto action;
+	/* an L4 item always implies its protocol, even when empty */
+	if (item->type != RTE_FLOW_ITEM_TYPE_END) {
+		uint8_t proto;
+
+		if (item->type == RTE_FLOW_ITEM_TYPE_TCP)
+			proto = IPPROTO_TCP;
+		else if (item->type == RTE_FLOW_ITEM_TYPE_UDP)
+			proto = IPPROTO_UDP;
+		else
+			proto = IPPROTO_SCTP;
+
+		if (filter->proto_mask != 0 && filter->proto != proto) {
+			*filter = (struct rte_eth_ntuple_filter){0};
+			rte_flow_error_set(error, EINVAL,
+				RTE_FLOW_ERROR_TYPE_ITEM,
+				item, "L4 item conflicts with IPv4 protocol");
+			return -rte_errno;
+		}
+		filter->proto = proto;
+		filter->proto_mask = UINT8_MAX;
+
+		if (item->spec == NULL && item->mask == NULL)
+			goto check_end;
 	}
 
 	/* get the TCP/UDP/SCTP info */
@@ -534,6 +554,7 @@ cons_parse_ntuple_filter(const struct rte_flow_attr *attr,
 		goto action;
 	}
 
+check_end:
 	/* check if the next not void item is END */
 	item = next_no_void_pattern(pattern, item);
 	if (item->type != RTE_FLOW_ITEM_TYPE_END) {
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-11-05 16:42:46.591620880 +0000
+++ 0041-net-ixgbe-fix-L4-protocol-parsing-for-ntuple.patch	2026-11-05 16:42:44.949061623 +0000
@@ -1 +1 @@
-From 1558685a98f3e15012aa95db9e91921b6d400d4c Mon Sep 17 00:00:00 2001
+From a17c45d2fdfe8ac7d65aaa0bda6c5be184c36889 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 1558685a98f3e15012aa95db9e91921b6d400d4c ]
+
@@ -21 +22,0 @@
-Cc: stable at dpdk.org
@@ -26 +27 @@
- drivers/net/intel/ixgbe/ixgbe_flow.c | 27 ++++++++++++++++++++++++---
+ drivers/net/ixgbe/ixgbe_flow.c | 27 ++++++++++++++++++++++++---
@@ -29,5 +30,5 @@
-diff --git a/drivers/net/intel/ixgbe/ixgbe_flow.c b/drivers/net/intel/ixgbe/ixgbe_flow.c
-index 547c6621d3..04f09409ec 100644
---- a/drivers/net/intel/ixgbe/ixgbe_flow.c
-+++ b/drivers/net/intel/ixgbe/ixgbe_flow.c
-@@ -358,9 +358,29 @@ cons_parse_ntuple_filter(const struct rte_flow_attr *attr,
+diff --git a/drivers/net/ixgbe/ixgbe_flow.c b/drivers/net/ixgbe/ixgbe_flow.c
+index f8dfb432f44..01a6811f858 100644
+--- a/drivers/net/ixgbe/ixgbe_flow.c
++++ b/drivers/net/ixgbe/ixgbe_flow.c
+@@ -402,9 +402,29 @@ cons_parse_ntuple_filter(const struct rte_flow_attr *attr,
@@ -66 +67 @@
-@@ -490,6 +510,7 @@ cons_parse_ntuple_filter(const struct rte_flow_attr *attr,
+@@ -534,6 +554,7 @@ cons_parse_ntuple_filter(const struct rte_flow_attr *attr,