Re: [PATCH net 1/7] net/mlx5e: ipsec: Block eswitch mode changes during policy creation

[sashiko-bot@kernel.org]

> From: Cosmin Ratiu <cratiu@nvidia.com>
> 
> Eswitch mode changes can tear down the IPsec context while policy
> creation is accessing it. The mode-blocking reference acquired when
> creating a flow table comes too late: the table lookup already accesses
> the IPsec context before taking that reference.
> 
> Block mode changes before checking the IPsec context and validating the
> policy. Release the temporary reference after successful setup, when the
> flow table holds its own reference, or after unwinding on failure.
> 
> Unfortunately, simply using mlx5_eswitch_block_mode() for this would
> introduce a regression where:
> 1. An offloaded inbound IPsec policy is added on the uplink.
> 2. A TC flower rule is added on a VF representor.
> 3. Another uplink IPsec policy using the same RX tables is added.
> 
> Before this change, the 3rd rule would reuse an existing RX/TX table
> from 1 and would avoid an mlx5_eswitch_block_mode() check in
> rx_get()/tx_get(). After this change, the temporary mode block added
> would reject the 3rd rule because esw->user_count > 0.
> 
> To avoid that, I was forced to separate the mode blocking from the TC
> check by introducing a check_users argument to
> mlx5_eswitch_block_mode().
> 
> Fixes: a5b8ca9471d3 ("net/mlx5e: Add XFRM policy offload logic")
> Signed-off-by: Cosmin Ratiu <cratiu@nvidia.com>
> Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com>
> Signed-off-by: Tariq Toukan <tariqt@nvidia.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260917175433.4090878-1-tariqt@nvidia.com?part=1