patch 'net/iavf: fix IPsec flow metadata leaks' has been queued to stable release 24.11.9

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.9

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 11/07/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/08f66cdc57cfd70ee1ca5c68fe27fc67c0fbd76e

Thanks.

Luca Boccassi

---
>From 08f66cdc57cfd70ee1ca5c68fe27fc67c0fbd76e Mon Sep 17 00:00:00 2001
From: Anatoly Burakov <anatoly.burakov at intel.com>
Date: Fri, 23 Oct 2026 10:32:30 +0100
Subject: [PATCH] net/iavf: fix IPsec flow metadata leaks

[ upstream commit a84241f2ca48a2c9579c5bca66ecf6a08e1c16f0 ]

IPsec flow parsing leaves the pattern-match item allocated after
extracting its metadata. It also leaves the parsed flow item allocated
when no metadata output is requested.

Free the pattern-match item after parsing and free the parsed flow item
when it cannot be returned to the caller. Propagate pattern-match failure
and report a parsing error when no flow item was produced.

Fixes: 6bc987ecb860 ("net/iavf: support IPsec inline crypto")

Signed-off-by: Anatoly Burakov <anatoly.burakov at intel.com>
Acked-by: Radu Nicolau <radu.nicolau at intel.com>
---
 drivers/net/iavf/iavf_ipsec_crypto.c | 31 +++++++++++++++++++---------
 1 file changed, 21 insertions(+), 10 deletions(-)

diff --git a/drivers/net/iavf/iavf_ipsec_crypto.c b/drivers/net/iavf/iavf_ipsec_crypto.c
index 6d551a23f6f..6003b2713f6 100644
--- a/drivers/net/iavf/iavf_ipsec_crypto.c
+++ b/drivers/net/iavf/iavf_ipsec_crypto.c
@@ -1955,23 +1955,34 @@ iavf_ipsec_flow_parse(struct iavf_adapter *ad,
 		      struct rte_flow_error *error)
 {
 	struct iavf_pattern_match_item *item = NULL;
-	int ret = -1;
+	struct iavf_ipsec_flow_item *fi = NULL;
 
 	if (priority >= 1)
 		return -rte_errno;
 
 	item = iavf_search_pattern_match_item(pattern, array, array_len, error);
-	if (item && item->meta) {
+	if (item == NULL)
+		return -rte_errno;
+
+	if (item->meta != NULL) {
 		uint32_t type = (uint64_t)(item->meta);
-		struct iavf_ipsec_flow_item *fi =
-				iavf_ipsec_flow_item_parse(ad->vf.eth_dev,
-						pattern, actions, type);
-		if (fi && meta) {
-			*meta = fi;
-			ret = 0;
-		}
+
+		fi = iavf_ipsec_flow_item_parse(ad->vf.eth_dev, pattern,
+				actions, type);
 	}
-	return ret;
+	rte_free(item);
+
+	if (fi == NULL)
+		return rte_flow_error_set(error, EINVAL,
+				RTE_FLOW_ERROR_TYPE_ACTION, NULL,
+				"Invalid IPsec flow.");
+
+	if (meta != NULL)
+		*meta = fi;
+	else
+		rte_free(fi);
+
+	return 0;
 }
 
 /*
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-11-05 16:42:47.054578700 +0000
+++ 0054-net-iavf-fix-IPsec-flow-metadata-leaks.patch	2026-11-05 16:42:44.965062101 +0000
@@ -1 +1 @@
-From a84241f2ca48a2c9579c5bca66ecf6a08e1c16f0 Mon Sep 17 00:00:00 2001
+From 08f66cdc57cfd70ee1ca5c68fe27fc67c0fbd76e Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit a84241f2ca48a2c9579c5bca66ecf6a08e1c16f0 ]
+
@@ -15 +16,0 @@
-Cc: stable at dpdk.org
@@ -20,2 +21,2 @@
- drivers/net/intel/iavf/iavf_ipsec_crypto.c | 28 +++++++++++++++-------
- 1 file changed, 20 insertions(+), 8 deletions(-)
+ drivers/net/iavf/iavf_ipsec_crypto.c | 31 +++++++++++++++++++---------
+ 1 file changed, 21 insertions(+), 10 deletions(-)
@@ -23,7 +24,7 @@
-diff --git a/drivers/net/intel/iavf/iavf_ipsec_crypto.c b/drivers/net/intel/iavf/iavf_ipsec_crypto.c
-index f7e391a74a..be0a0d0df6 100644
---- a/drivers/net/intel/iavf/iavf_ipsec_crypto.c
-+++ b/drivers/net/intel/iavf/iavf_ipsec_crypto.c
-@@ -1942,6 +1942,7 @@ iavf_ipsec_flow_parse(struct iavf_adapter *ad,
- 		.max_actions = 1,
- 	};
+diff --git a/drivers/net/iavf/iavf_ipsec_crypto.c b/drivers/net/iavf/iavf_ipsec_crypto.c
+index 6d551a23f6f..6003b2713f6 100644
+--- a/drivers/net/iavf/iavf_ipsec_crypto.c
++++ b/drivers/net/iavf/iavf_ipsec_crypto.c
+@@ -1955,23 +1955,34 @@ iavf_ipsec_flow_parse(struct iavf_adapter *ad,
+ 		      struct rte_flow_error *error)
+ {
@@ -30,0 +32 @@
+-	int ret = -1;
@@ -32 +33,0 @@
- 	int ret = -1;
@@ -34,3 +35,2 @@
- 	ret = ci_flow_check_attr(attr, NULL, error);
-@@ -1953,17 +1954,28 @@ iavf_ipsec_flow_parse(struct iavf_adapter *ad,
- 		return ret;
+ 	if (priority >= 1)
+ 		return -rte_errno;
@@ -44 +43,0 @@
- 		const struct rte_security_session *session = parsed_actions.actions[0]->conf;
@@ -47 +46,2 @@
--				iavf_ipsec_flow_item_parse(ad, pattern, session, type);
+-				iavf_ipsec_flow_item_parse(ad->vf.eth_dev,
+-						pattern, actions, type);
@@ -53 +53,2 @@
-+		fi = iavf_ipsec_flow_item_parse(ad, pattern, session, type);
++		fi = iavf_ipsec_flow_item_parse(ad->vf.eth_dev, pattern,
++				actions, type);