From: Usman Malik <usmalik90@gmail.com>
To: "Jérémy Jean" <Jeremy.Jean@oss.cyber.gouv.fr>
Cc: Steffen Klassert <steffen.klassert@secunet.com>,
Herbert Xu <herbert@gondor.apana.org.au>,
Sabrina Dubroca <sd@queasysnail.net>,
"David S. Miller" <davem@davemloft.net>,
Boris Pismenny <borisp@nvidia.com>,
Saeed Mahameed <saeedm@nvidia.com>,
Leon Romanovsky <leonro@nvidia.com>,
Tariq Toukan <tariqt@nvidia.com>, Mark Bloch <mbloch@nvidia.com>,
netdev@vger.kernel.org, linux-rdma@vger.kernel.org,
linux-kernel@vger.kernel.org, stable@vger.kernel.org
Subject: Re: [PATCH ipsec v2 4/7] xfrm: prevent AES-GCM nonce reuse after early GSO
Date: Thu, 12 Nov 2026 11:15:06 +0100 [thread overview]
Message-ID: <7A2301CE-C145-4CB2-81CA-4A2BACBA8430@gmail.com> (raw)
In-Reply-To: <20261108142652.1330952-5-Jeremy.Jean@oss.cyber.gouv.fr>
On Sun, 8 Nov 2026 14:26:49 +0000, Jeremy Jean wrote:
> With software ESP offload, xfrm_output() attaches a secpath before
> calling xfrm_output_gso() for an encapsulated GSO packet, but
> skb_gso_segment() leaves the splitted skbs sharing the same secpath,
> including xo->seq.
I tested v1 of this patch and posted the results in the v1 thread:
https://lore.kernel.org/netdev/20260930144523.435271-6-Jeremy.Jean@oss.cyber.gouv.fr/T/
In v2 only the commit message and the code comment changed, the code
is the same, so the results hold.
Tested-by: Usman Malik <usmanmalik@engineer.com>
next prev parent reply other threads:[~2026-11-12 10:15 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-08 14:26 [PATCH ipsec v2 0/7] xfrm: fix ESP IV generation and ESN authentication Jérémy Jean
2026-11-08 14:26 ` [PATCH ipsec v2 1/7] xfrm: esp6: use the current sequence number for the IV Jérémy Jean
2026-11-09 14:27 ` sashiko-bot
2026-11-12 10:14 ` Usman Malik
2026-11-08 14:26 ` [PATCH ipsec v2 2/7] xfrm: esp4: " Jérémy Jean
2026-11-09 14:27 ` sashiko-bot
2026-11-08 14:26 ` [PATCH ipsec v2 3/7] xfrm: esp: use the current sequence number for AAD and offload Jérémy Jean
2026-11-09 14:27 ` sashiko-bot
2026-11-09 15:08 ` netdev-bot+sashiko
2026-11-08 14:26 ` [PATCH ipsec v2 4/7] xfrm: prevent AES-GCM nonce reuse after early GSO Jérémy Jean
2026-11-09 14:27 ` sashiko-bot
2026-11-09 15:08 ` netdev-bot+sashiko
2026-11-12 10:15 ` Usman Malik [this message]
2026-11-08 14:26 ` [PATCH ipsec v2 5/7] net/mlx5e: Use the packet sequence number for the IPsec IV Jérémy Jean
2026-11-09 14:27 ` sashiko-bot
2026-11-12 12:03 ` Tariq Toukan
2026-11-08 14:26 ` [PATCH ipsec v2 6/7] xfrm: segment untrusted GSO packets before sequence allocation Jérémy Jean
2026-11-09 14:27 ` sashiko-bot
2026-11-09 15:08 ` netdev-bot+sashiko
2026-11-08 14:26 ` [PATCH ipsec v2 7/7] xfrm: leave the sequence counter unchanged on ESN overflow Jérémy Jean
2026-11-09 14:27 ` sashiko-bot
2026-11-08 14:32 ` [PATCH ipsec v2 0/7] xfrm: fix ESP IV generation and ESN authentication netdev-bot+sinfo
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=7A2301CE-C145-4CB2-81CA-4A2BACBA8430@gmail.com \
--to=usmalik90@gmail.com \
--cc=Jeremy.Jean@oss.cyber.gouv.fr \
--cc=borisp@nvidia.com \
--cc=davem@davemloft.net \
--cc=herbert@gondor.apana.org.au \
--cc=leonro@nvidia.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-rdma@vger.kernel.org \
--cc=mbloch@nvidia.com \
--cc=netdev@vger.kernel.org \
--cc=saeedm@nvidia.com \
--cc=sd@queasysnail.net \
--cc=stable@vger.kernel.org \
--cc=steffen.klassert@secunet.com \
--cc=tariqt@nvidia.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.