From: Steffen Klassert <steffen.klassert@secunet.com>
To: Cosmin Ratiu <cratiu@nvidia.com>
Cc: <netdev@vger.kernel.org>, Jay Vosburgh <jv@jvosburgh.net>,
Andrew Lunn <andrew+netdev@lunn.ch>,
"David S. Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>,
Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
Simon Horman <horms@kernel.org>, Taehee Yoo <ap420073@gmail.com>,
Jianbo Liu <jianbol@nvidia.com>,
Sabrina Dubroca <sd@queasysnail.net>,
Herbert Xu <herbert@gondor.apana.org.au>,
Leon Romanovsky <leonro@nvidia.com>
Subject: Re: [RFC PATCH ipsec 0/2] Fix bonding IPSec races
Date: Mon, 1 Dec 2025 10:01:41 +0100 [thread overview]
Message-ID: <aS1ZdbElmUB7VyPU@secunet.com> (raw)
In-Reply-To: <20251121151644.1797728-1-cratiu@nvidia.com>
On Fri, Nov 21, 2025 at 05:16:42PM +0200, Cosmin Ratiu wrote:
> These patches are an alternate proposed fix to the bonding IPSec races
> which could result in unencrypted IPSec packets on the wire.
> I'm sending them as RFC based on the discussion with Sabrina on the
> primary approach [1].
>
> [1] https://lore.kernel.org/netdev/20251113104310.1243150-1-cratiu@nvidia.com/T/#u
>
> Cosmin Ratiu (2):
> xfrm: Add explicit offload_handle to some xfrm callbacks
> bonding: Maintain offloaded xfrm on all devices
>
> Documentation/networking/xfrm_device.rst | 13 +-
> drivers/net/bonding/bond_main.c | 284 ++++++++++--------
> .../net/ethernet/chelsio/cxgb4/cxgb4_main.c | 20 +-
> .../inline_crypto/ch_ipsec/chcr_ipsec.c | 25 +-
> .../net/ethernet/intel/ixgbe/ixgbe_ipsec.c | 47 +--
> drivers/net/ethernet/intel/ixgbevf/ipsec.c | 18 +-
> .../marvell/octeontx2/nic/cn10k_ipsec.c | 13 +-
> .../mellanox/mlx5/core/en_accel/ipsec.c | 26 +-
> .../net/ethernet/netronome/nfp/crypto/ipsec.c | 10 +-
> drivers/net/netdevsim/ipsec.c | 8 +-
> include/linux/netdevice.h | 7 +-
> include/net/bonding.h | 22 +-
> net/xfrm/xfrm_device.c | 3 +-
> net/xfrm/xfrm_state.c | 7 +-
> 14 files changed, 295 insertions(+), 208 deletions(-)
There are only minor changes to the IPsec subsystem,
compared to drivers and bonding. Also this is a rather
big change for a fix. So if this patchset should go to
the ipsec tree, we would need some ACKs from the drivers
an bonding maintainers.
prev parent reply other threads:[~2025-12-01 9:01 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-11-21 15:16 [RFC PATCH ipsec 0/2] Fix bonding IPSec races Cosmin Ratiu
2025-11-21 15:16 ` [RFC PATCH ipsec 1/2] xfrm: Add explicit offload_handle to some xfrm callbacks Cosmin Ratiu
2025-11-21 15:16 ` [RFC PATCH ipsec 2/2] bonding: Maintain offloaded xfrm on all devices Cosmin Ratiu
2025-12-05 3:48 ` Hangbin Liu
2025-12-01 9:01 ` Steffen Klassert [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aS1ZdbElmUB7VyPU@secunet.com \
--to=steffen.klassert@secunet.com \
--cc=andrew+netdev@lunn.ch \
--cc=ap420073@gmail.com \
--cc=cratiu@nvidia.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=herbert@gondor.apana.org.au \
--cc=horms@kernel.org \
--cc=jianbol@nvidia.com \
--cc=jv@jvosburgh.net \
--cc=kuba@kernel.org \
--cc=leonro@nvidia.com \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=sd@queasysnail.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.