patch 'net/iavf: fix leak on IPsec init failure' has been queued to stable release 24.11.9

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.9

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 10/29/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/ed686951b4693840dad998a1938c6b78c9706fb9

Thanks.

Luca Boccassi

---
>From ed686951b4693840dad998a1938c6b78c9706fb9 Mon Sep 17 00:00:00 2001
From: Anatoly Burakov <anatoly.burakov at intel.com>
Date: Tue, 15 Sep 2026 09:37:00 +0100
Subject: [PATCH] net/iavf: fix leak on IPsec init failure

[ upstream commit 2f99eaab75a8197cd89d1923144f525dfc5f25f4 ]

Currently, during `dev_init`, we try to create a security context. At that
point we have already initialized the rte_flow engines, so any subsequent
failures must trigger flow engines uninit. However, if we fail to create a
security context (or if its initialization fails), we do not uninit the
rte_flow engines. Fix the code to do so on failure.

Fixes: 45570d7e4439 ("net/iavf: fix resource leak on probing failure")

Signed-off-by: Anatoly Burakov <anatoly.burakov at intel.com>
Acked-by: Radu Nicolau <radu.nicolau at intel.com>
---
 drivers/net/iavf/iavf_ethdev.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/iavf/iavf_ethdev.c b/drivers/net/iavf/iavf_ethdev.c
index 166d8447718..bd3c394aa08 100644
--- a/drivers/net/iavf/iavf_ethdev.c
+++ b/drivers/net/iavf/iavf_ethdev.c
@@ -2905,7 +2905,7 @@ iavf_dev_init(struct rte_eth_dev *eth_dev)
 		ret = iavf_security_ctx_create(adapter);
 		if (ret) {
 			PMD_INIT_LOG(ERR, "failed to create ipsec crypto security instance");
-			goto flow_init_err;
+			goto security_init_err;
 		}
 
 		ret = iavf_security_init(adapter);
@@ -2935,6 +2935,7 @@ iavf_dev_init(struct rte_eth_dev *eth_dev)
 
 security_init_err:
 	iavf_security_ctx_destroy(adapter);
+	iavf_flow_uninit(adapter);
 
 flow_init_err:
 	iavf_disable_irq0(hw);
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-10-27 11:43:57.239778935 +0000
+++ 0091-net-iavf-fix-leak-on-IPsec-init-failure.patch	2026-10-27 11:43:53.614062544 +0000
@@ -1 +1 @@
-From 2f99eaab75a8197cd89d1923144f525dfc5f25f4 Mon Sep 17 00:00:00 2001
+From ed686951b4693840dad998a1938c6b78c9706fb9 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 2f99eaab75a8197cd89d1923144f525dfc5f25f4 ]
+
@@ -13 +14,0 @@
-Cc: stable at dpdk.org
@@ -18 +19 @@
- drivers/net/intel/iavf/iavf_ethdev.c | 3 ++-
+ drivers/net/iavf/iavf_ethdev.c | 3 ++-
@@ -21,5 +22,5 @@
-diff --git a/drivers/net/intel/iavf/iavf_ethdev.c b/drivers/net/intel/iavf/iavf_ethdev.c
-index bdebd74629..a8abe0154c 100644
---- a/drivers/net/intel/iavf/iavf_ethdev.c
-+++ b/drivers/net/intel/iavf/iavf_ethdev.c
-@@ -3156,7 +3156,7 @@ iavf_dev_init(struct rte_eth_dev *eth_dev)
+diff --git a/drivers/net/iavf/iavf_ethdev.c b/drivers/net/iavf/iavf_ethdev.c
+index 166d8447718..bd3c394aa08 100644
+--- a/drivers/net/iavf/iavf_ethdev.c
++++ b/drivers/net/iavf/iavf_ethdev.c
+@@ -2905,7 +2905,7 @@ iavf_dev_init(struct rte_eth_dev *eth_dev)
@@ -34 +35 @@
-@@ -3186,6 +3186,7 @@ iavf_dev_init(struct rte_eth_dev *eth_dev)
+@@ -2935,6 +2935,7 @@ iavf_dev_init(struct rte_eth_dev *eth_dev)
@@ -41 +42 @@
- 	vf->aq_intr_enabled = false;
+ 	iavf_disable_irq0(hw);