Re: [PATCH net V2 2/4] net/mlx5e: ipsec: Block eswitch mode changes before accessing priv->ipsec

[sashiko-bot@kernel.org]

> From: Cosmin Ratiu <cratiu@nvidia.com>
> 
> mlx5e_xfrm_add_state() reads priv->ipsec and validates mode-dependent
> capabilities before blocking eswitch mode changes. A concurrent profile
> change can free the saved IPsec context and cause use-after-free.
> 
> Move the mode block before saving the IPsec context and validating the
> state, and release it on all error paths. Retain an early availability
> check to preserve software fallback when IPsec is unavailable, and check
> the context again after taking the mode block. Keep the atomic
> acquire-placeholder path exempt, since it creates no hardware state and
> cannot take sleeping locks.
> 
> As in policy creation, do not check eswitch users when taking this
> temporary mode block. This allows states to reuse existing IPsec tables
> when TC rules exist on VF representors, instead of rejecting them
> unconditionally. New RX/TX tables still check eswitch users, and the
> TC/IPsec exclusion counters still reject conflicting packet offloads.
> 
> Fixes: 22239eb258bc ("net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed")
> Signed-off-by: Cosmin Ratiu <cratiu@nvidia.com>
> Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com>
> Signed-off-by: Tariq Toukan <tariqt@nvidia.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260930121119.141953-1-tariqt@nvidia.com?part=2