The issue is probably generic, but I can see it when enabling ASan (passing -Db_sanitize=address meson option): FAILED: examples/dpdk-ipsec-secgw.p/ipsec-secgw_ipsec.c.o cc -Iexamples/dpdk-ipsec-secgw.p -Iexamples -I../../dpdk/examples -Iexamples/ipsec-secgw -I../../dpdk/examples/ipsec-secgw -I. -I../../dpdk -Iconfig -I../../dpdk/config -Ilib/eal/include -I../../dpdk/lib/eal/include -Ilib/eal/linux/include -I../../dpdk/lib/eal/linux/include -Ilib/eal/x86/include -I../../dpdk/lib/eal/x86/include -Ilib/eal/common -I../../dpdk/lib/eal/common -Ilib/eal -I../../dpdk/lib/eal -Ilib/kvargs -I../../dpdk/lib/kvargs -Ilib/metrics -I../../dpdk/lib/metrics -Ilib/telemetry -I../../dpdk/lib/telemetry -Ilib/mempool -I../../dpdk/lib/mempool -Ilib/ring -I../../dpdk/lib/ring -Ilib/net -I../../dpdk/lib/net -Ilib/mbuf -I../../dpdk/lib/mbuf -Ilib/ethdev -I../../dpdk/lib/ethdev -Ilib/meter -I../../dpdk/lib/meter -Ilib/cmdline -I../../dpdk/lib/cmdline -Ilib/security -I../../dpdk/lib/security -Ilib/cryptodev -I../../dpdk/lib/cryptodev -Ilib/rcu -I../../dpdk/lib/rcu -Ilib/lpm -I../../dpdk/lib/lpm -Ilib/hash -I../../dpdk/lib/hash -Ilib/acl -I../../dpdk/lib/acl -Ilib/ip_frag -I../../dpdk/lib/ip_frag -Ilib/ipsec -I../../dpdk/lib/ipsec -Ilib/eventdev -I../../dpdk/lib/eventdev -Ilib/timer -I../../dpdk/lib/timer -fdiagnostics-color=always -fsanitize=address -fno-omit-frame-pointer -D_FILE_OFFSET_BITS=64 -Wall -Winvalid-pch -Werror -O2 -g -include rte_config.h -Wextra -Wcast-qual -Wdeprecated -Wformat -Wformat-nonliteral -Wformat-security -Wmissing-declarations -Wmissing-prototypes -Wnested-externs -Wold-style-definition -Wpointer-arith -Wsign-compare -Wstrict-prototypes -Wundef -Wwrite-strings -Wno-address-of-packed-member -Wno-packed-not-aligned -Wno-missing-field-initializers -Wno-zero-length-bounds -D_GNU_SOURCE -march=nehalem -Wno-format-truncation -DALLOW_EXPERIMENTAL_API -MD -MQ examples/dpdk-ipsec-secgw.p/ipsec-secgw_ipsec.c.o -MF examples/dpdk-ipsec-secgw.p/ipsec-secgw_ipsec.c.o.d -o examples/dpdk-ipsec-secgw.p/ipsec-secgw_ipsec.c.o -c ../../dpdk/examples/ipsec-secgw/ipsec.c ../../dpdk/examples/ipsec-secgw/ipsec.c: In function ‘create_inline_session’: ../../dpdk/examples/ipsec-secgw/ipsec.c:314:31: error: ‘rte_flow_validate’ reading 32 bytes from a region of size 4 [-Werror=stringop-overread] 314 | ret = rte_flow_validate(sa->portid, &sa->attr, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 315 | sa->pattern, sa->action, | ~~~~~~~~~~~~~~~~~~~~~~~~ 316 | &err); | ~~~~~ ../../dpdk/examples/ipsec-secgw/ipsec.c:314:31: note: referencing argument 3 of type ‘const struct rte_flow_item *’ ../../dpdk/examples/ipsec-secgw/ipsec.c:314:31: error: ‘rte_flow_validate’ reading 16 bytes from a region of size 4 [-Werror=stringop-overread] ../../dpdk/examples/ipsec-secgw/ipsec.c:314:31: note: referencing argument 4 of type ‘const struct rte_flow_action *’ In file included from ../../dpdk/lib/ethdev/rte_eth_ctrl.h:11, from ../../dpdk/lib/ethdev/rte_ethdev.h:1421, from ../../dpdk/examples/ipsec-secgw/ipsec.c:14: ../../dpdk/lib/ethdev/rte_flow.h:4043:1: note: in a call to function ‘rte_flow_validate’ 4043 | rte_flow_validate(uint16_t port_id, | ^~~~~~~~~~~~~~~~~ ../../dpdk/examples/ipsec-secgw/ipsec.c:325:31: error: ‘rte_flow_validate’ reading 32 bytes from a region of size 4 [-Werror=stringop-overread] 325 | ret = rte_flow_validate(sa->portid, &sa->attr, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 326 | sa->pattern, sa->action, | ~~~~~~~~~~~~~~~~~~~~~~~~ 327 | &err); | ~~~~~ ../../dpdk/examples/ipsec-secgw/ipsec.c:325:31: note: referencing argument 3 of type ‘const struct rte_flow_item *’ ../../dpdk/examples/ipsec-secgw/ipsec.c:325:31: error: ‘rte_flow_validate’ reading 16 bytes from a region of size 4 [-Werror=stringop-overread] ../../dpdk/examples/ipsec-secgw/ipsec.c:325:31: note: referencing argument 4 of type ‘const struct rte_flow_action *’ In file included from ../../dpdk/lib/ethdev/rte_eth_ctrl.h:11, from ../../dpdk/lib/ethdev/rte_ethdev.h:1421, from ../../dpdk/examples/ipsec-secgw/ipsec.c:14: ../../dpdk/lib/ethdev/rte_flow.h:4043:1: note: in a call to function ‘rte_flow_validate’ 4043 | rte_flow_validate(uint16_t port_id, | ^~~~~~~~~~~~~~~~~ ../../dpdk/examples/ipsec-secgw/ipsec.c:331:31: error: ‘rte_flow_validate’ reading 32 bytes from a region of size 4 [-Werror=stringop-overread] 331 | ret = rte_flow_validate(sa->portid, &sa->attr, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 332 | sa->pattern, sa->action, | ~~~~~~~~~~~~~~~~~~~~~~~~ 333 | &err); | ~~~~~ ../../dpdk/examples/ipsec-secgw/ipsec.c:331:31: note: referencing argument 3 of type ‘const struct rte_flow_item *’ ../../dpdk/examples/ipsec-secgw/ipsec.c:331:31: error: ‘rte_flow_validate’ reading 16 bytes from a region of size 4 [-Werror=stringop-overread] ../../dpdk/examples/ipsec-secgw/ipsec.c:331:31: note: referencing argument 4 of type ‘const struct rte_flow_action *’ In file included from ../../dpdk/lib/ethdev/rte_eth_ctrl.h:11, from ../../dpdk/lib/ethdev/rte_ethdev.h:1421, from ../../dpdk/examples/ipsec-secgw/ipsec.c:14: ../../dpdk/lib/ethdev/rte_flow.h:4043:1: note: in a call to function ‘rte_flow_validate’ 4043 | rte_flow_validate(uint16_t port_id, | ^~~~~~~~~~~~~~~~~ ../../dpdk/examples/ipsec-secgw/ipsec.c:345:28: error: ‘rte_flow_create’ reading 32 bytes from a region of size 4 [-Werror=stringop-overread] 345 | sa->flow = rte_flow_create(sa->portid, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ 346 | &sa->attr, sa->pattern, sa->action, &err); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ../../dpdk/examples/ipsec-secgw/ipsec.c:345:28: note: referencing argument 3 of type ‘const struct rte_flow_item *’ ../../dpdk/examples/ipsec-secgw/ipsec.c:345:28: error: ‘rte_flow_create’ reading 16 bytes from a region of size 4 [-Werror=stringop-overread] ../../dpdk/examples/ipsec-secgw/ipsec.c:345:28: note: referencing argument 4 of type ‘const struct rte_flow_action *’ In file included from ../../dpdk/lib/ethdev/rte_eth_ctrl.h:11, from ../../dpdk/lib/ethdev/rte_ethdev.h:1421, from ../../dpdk/examples/ipsec-secgw/ipsec.c:14: ../../dpdk/lib/ethdev/rte_flow.h:4070:1: note: in a call to function ‘rte_flow_create’ 4070 | rte_flow_create(uint16_t port_id, | ^~~~~~~~~~~~~~~ ../../dpdk/examples/ipsec-secgw/ipsec.c: In function ‘create_ipsec_esp_flow’: ../../dpdk/examples/ipsec-secgw/ipsec.c:473:15: error: ‘rte_flow_validate’ reading 32 bytes from a region of size 4 [-Werror=stringop-overread] 473 | ret = rte_flow_validate(sa->portid, &sa->attr, sa->pattern, sa->action, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 474 | &err); | ~~~~~ ../../dpdk/examples/ipsec-secgw/ipsec.c:473:15: note: referencing argument 3 of type ‘const struct rte_flow_item *’ ../../dpdk/examples/ipsec-secgw/ipsec.c:473:15: error: ‘rte_flow_validate’ reading 16 bytes from a region of size 4 [-Werror=stringop-overread] ../../dpdk/examples/ipsec-secgw/ipsec.c:473:15: note: referencing argument 4 of type ‘const struct rte_flow_action *’ In file included from ../../dpdk/lib/ethdev/rte_eth_ctrl.h:11, from ../../dpdk/lib/ethdev/rte_ethdev.h:1421, from ../../dpdk/examples/ipsec-secgw/ipsec.c:14: ../../dpdk/lib/ethdev/rte_flow.h:4043:1: note: in a call to function ‘rte_flow_validate’ 4043 | rte_flow_validate(uint16_t port_id, | ^~~~~~~~~~~~~~~~~ ../../dpdk/examples/ipsec-secgw/ipsec.c:480:20: error: ‘rte_flow_create’ reading 32 bytes from a region of size 4 [-Werror=stringop-overread] 480 | sa->flow = rte_flow_create(sa->portid, &sa->attr, sa->pattern, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 481 | sa->action, &err); | ~~~~~~~~~~~~~~~~~ ../../dpdk/examples/ipsec-secgw/ipsec.c:480:20: note: referencing argument 3 of type ‘const struct rte_flow_item *’ ../../dpdk/examples/ipsec-secgw/ipsec.c:480:20: error: ‘rte_flow_create’ reading 16 bytes from a region of size 4 [-Werror=stringop-overread] ../../dpdk/examples/ipsec-secgw/ipsec.c:480:20: note: referencing argument 4 of type ‘const struct rte_flow_action *’ In file included from ../../dpdk/lib/ethdev/rte_eth_ctrl.h:11, from ../../dpdk/lib/ethdev/rte_ethdev.h:1421, from ../../dpdk/examples/ipsec-secgw/ipsec.c:14: ../../dpdk/lib/ethdev/rte_flow.h:4070:1: note: in a call to function ‘rte_flow_create’ 4070 | rte_flow_create(uint16_t port_id, | ^~~~~~~~~~~~~~~ cc1: all warnings being treated as errors
Sorry for the long delay! It looks like a false positive; if I replace the sa->pattern and sa->action (de)references with local variables e.g. + struct rte_flow_item *pattern = sa->pattern; + struct rte_flow_action *action = sa->action; and use pattern and action instead the error goes away.