[PATCH net V2 0/4] mlx5 misc fixes 2026-01-27

[PATCH net V2 0/4] mlx5 misc fixes 2026-01-27

[Tariq Toukan]

Hi,

This patchset provides misc bug fixes from the team to the mlx5 core and
Eth drivers.

Thanks,
Tariq.

V2:
- Fix issue in patch #4 (AI-generated review).
- Add review tags (Simon).
- Link to V1: https://lore.kernel.org/all/20260120081654.1639138-1-tariqt@nvidia.com/


Cosmin Ratiu (1):
  net/mlx5: Fix deadlock between devlink lock and esw->wq

Jianbo Liu (1):
  net/mlx5e: Skip ESN replay window setup for IPsec crypto offload

Parav Pandit (1):
  net/mlx5: Fix vhca_id access call trace use before alloc

Shay Drory (1):
  net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect

 .../net/ethernet/mellanox/mlx5/core/debugfs.c    | 16 ++++++++++++++++
 .../ethernet/mellanox/mlx5/core/en_accel/ipsec.c |  3 ++-
 .../net/ethernet/mellanox/mlx5/core/eswitch.c    |  6 +++++-
 .../net/ethernet/mellanox/mlx5/core/eswitch.h    |  1 +
 .../mellanox/mlx5/core/eswitch_offloads.c        | 12 +++++++++++-
 drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c |  3 ++-
 drivers/net/ethernet/mellanox/mlx5/core/main.c   | 14 +++-----------
 .../net/ethernet/mellanox/mlx5/core/mlx5_core.h  |  1 +
 .../ethernet/mellanox/mlx5/core/sf/dev/driver.c  |  1 +
 9 files changed, 42 insertions(+), 15 deletions(-)


base-commit: 165c34fb6068ff153e3fc99a932a80a9d5755709
-- 
2.40.1

[PATCH net V2 1/4] net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect

[Tariq Toukan]

From: Shay Drory <shayd@nvidia.com>

The capability check for reset_root_to_default was inverted, causing
the function to return -EOPNOTSUPP when the capability IS supported,
rather than when it is NOT supported.

Fix the capability check condition.

Fixes: 3c9c34c32bc6 ("net/mlx5: fs, Command to control TX flow table root")
Signed-off-by: Shay Drory <shayd@nvidia.com>
Reviewed-by: Mark Bloch <mbloch@nvidia.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
---
 drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c
index ced747bef641..c348ee62cd3a 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c
@@ -1198,7 +1198,8 @@ int mlx5_fs_cmd_set_tx_flow_table_root(struct mlx5_core_dev *dev, u32 ft_id, boo
 	u32 out[MLX5_ST_SZ_DW(set_flow_table_root_out)] = {};
 	u32 in[MLX5_ST_SZ_DW(set_flow_table_root_in)] = {};
 
-	if (disconnect && MLX5_CAP_FLOWTABLE_NIC_TX(dev, reset_root_to_default))
+	if (disconnect &&
+	    !MLX5_CAP_FLOWTABLE_NIC_TX(dev, reset_root_to_default))
 		return -EOPNOTSUPP;
 
 	MLX5_SET(set_flow_table_root_in, in, opcode,
-- 
2.40.1

[PATCH net V2 2/4] net/mlx5: Fix deadlock between devlink lock and esw->wq

[Tariq Toukan]

From: Cosmin Ratiu <cratiu@nvidia.com>

esw_functions_changed_event_handler -> esw_vfs_changed_event_handler is
called from the esw->work_queue and acquires the devlink lock.

Changing the esw mode is done via .eswitch_mode_set (acquires devlink
lock in the devlink_nl_pre_doit call) -> mlx5_devlink_eswitch_mode_set
-> mlx5_eswitch_disable_locked -> mlx5_eswitch_event_handler_unregister
-> flush_workqueue.

This creates a circular lock dependency which could lead to a real
deadlock, as the code flushing the workqueue is holding the devlink
lock, and the work handler being flushed could try to acquire it.

Fix that by adding a new bool field 'notifier_enabled' next to the event
handler scheduling the work, keeping it true while the notifier is
active, and using it to repeatedly try to acquire the devlink lock from
the work handler while true, with a slight delay to avoid busy looping.

This avoids the deadlock because the event handler will be removed
first (turning 'notifier_enabled' false), and the work handler will
eventually give up in acquiring the lock because the work is no longer
necessary.

Fixes: f1bc646c9a06 ("net/mlx5: Use devl_ API in mlx5_esw_offloads_devlink_port_register")
Signed-off-by: Cosmin Ratiu <cratiu@nvidia.com>
Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
---
 drivers/net/ethernet/mellanox/mlx5/core/eswitch.c    |  6 +++++-
 drivers/net/ethernet/mellanox/mlx5/core/eswitch.h    |  1 +
 .../ethernet/mellanox/mlx5/core/eswitch_offloads.c   | 12 +++++++++++-
 3 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
index 4b7a1ce7f406..fddc3b33222d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
@@ -1066,14 +1066,18 @@ static void mlx5_eswitch_event_handler_register(struct mlx5_eswitch *esw)
 	if (esw->mode == MLX5_ESWITCH_OFFLOADS && mlx5_eswitch_is_funcs_handler(esw->dev)) {
 		MLX5_NB_INIT(&esw->esw_funcs.nb, mlx5_esw_funcs_changed_handler,
 			     ESW_FUNCTIONS_CHANGED);
+		esw->esw_funcs.notifier_enabled = true;
 		mlx5_eq_notifier_register(esw->dev, &esw->esw_funcs.nb);
 	}
 }
 
 static void mlx5_eswitch_event_handler_unregister(struct mlx5_eswitch *esw)
 {
-	if (esw->mode == MLX5_ESWITCH_OFFLOADS && mlx5_eswitch_is_funcs_handler(esw->dev))
+	if (esw->mode == MLX5_ESWITCH_OFFLOADS &&
+	    mlx5_eswitch_is_funcs_handler(esw->dev)) {
+		esw->esw_funcs.notifier_enabled = false;
 		mlx5_eq_notifier_unregister(esw->dev, &esw->esw_funcs.nb);
+	}
 
 	flush_workqueue(esw->work_queue);
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
index e7fe43799b23..af35312a8ced 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
@@ -338,6 +338,7 @@ struct mlx5_host_work {
 
 struct mlx5_esw_functions {
 	struct mlx5_nb		nb;
+	bool                    notifier_enabled;
 	bool			host_funcs_disabled;
 	u16			num_vfs;
 	u16			num_ec_vfs;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
index ea94a727633f..0199bea2cb31 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
@@ -3597,7 +3597,17 @@ esw_vfs_changed_event_handler(struct mlx5_eswitch *esw, const u32 *out)
 		return;
 
 	devlink = priv_to_devlink(esw->dev);
-	devl_lock(devlink);
+	/* Repeatedly try to grab the lock with a delay while this work is
+	 * still relevant.
+	 * This allows a concurrent mlx5_eswitch_event_handler_unregister
+	 * (holding the devlink lock) to flush the wq without deadlocking.
+	 */
+	while (!devl_trylock(devlink)) {
+		if (!esw->esw_funcs.notifier_enabled)
+			return;
+		schedule_timeout_interruptible(msecs_to_jiffies(10));
+	}
+
 	/* Number of VFs can only change from "0 to x" or "x to 0". */
 	if (esw->esw_funcs.num_vfs > 0) {
 		mlx5_eswitch_unload_vf_vports(esw, esw->esw_funcs.num_vfs);
-- 
2.40.1

Re: [PATCH net V2 2/4] net/mlx5: Fix deadlock between devlink lock and esw->wq

[Jakub Kicinski]

On Tue, 27 Jan 2026 10:52:39 +0200 Tariq Toukan wrote:
> esw_functions_changed_event_handler -> esw_vfs_changed_event_handler is
> called from the esw->work_queue and acquires the devlink lock.
> 
> Changing the esw mode is done via .eswitch_mode_set (acquires devlink
> lock in the devlink_nl_pre_doit call) -> mlx5_devlink_eswitch_mode_set
> -> mlx5_eswitch_disable_locked -> mlx5_eswitch_event_handler_unregister
> -> flush_workqueue.  

This is quite an ugly hack, is there no way to avoid the flush and let 
the work discover that what it was supposed to do is no longer needed?

>  	devlink = priv_to_devlink(esw->dev);
> -	devl_lock(devlink);
> +	/* Repeatedly try to grab the lock with a delay while this work is
> +	 * still relevant.
> +	 * This allows a concurrent mlx5_eswitch_event_handler_unregister
> +	 * (holding the devlink lock) to flush the wq without deadlocking.
> +	 */
> +	while (!devl_trylock(devlink)) {
> +		if (!esw->esw_funcs.notifier_enabled)

Technically READ_ONCE/WRITE_ONCE is required on this.

> +			return;
> +		schedule_timeout_interruptible(msecs_to_jiffies(10));

Why _interruptible(), you're not handling the return value.
If somehow this thread gets a signal pending we'll turn this
loop into a busy poll which doesn't seem ideal?


Ima take this patch out of the series and apply the rest.

Re: [PATCH net V2 2/4] net/mlx5: Fix deadlock between devlink lock and esw->wq

[Cosmin Ratiu]

On Wed, 2026-01-28 at 20:56 -0800, Jakub Kicinski wrote:
> On Tue, 27 Jan 2026 10:52:39 +0200 Tariq Toukan wrote:
> > esw_functions_changed_event_handler ->
> > esw_vfs_changed_event_handler is
> > called from the esw->work_queue and acquires the devlink lock.
> > 
> > Changing the esw mode is done via .eswitch_mode_set (acquires
> > devlink
> > lock in the devlink_nl_pre_doit call) ->
> > mlx5_devlink_eswitch_mode_set
> > -> mlx5_eswitch_disable_locked ->
> > mlx5_eswitch_event_handler_unregister
> > -> flush_workqueue.  
> 
> This is quite an ugly hack, is there no way to avoid the flush and
> let 
> the work discover that what it was supposed to do is no longer
> needed?

Not possible, unfortunately. I stared at it for quite a while. The wq
is flushed because the esw is being unconfigured, which removes data
structs the work handler uses. Flushing the work is required, otherwise
we'll run into worse issues.

> 
> >  	devlink = priv_to_devlink(esw->dev);
> > -	devl_lock(devlink);
> > +	/* Repeatedly try to grab the lock with a delay while this
> > work is
> > +	 * still relevant.
> > +	 * This allows a concurrent
> > mlx5_eswitch_event_handler_unregister
> > +	 * (holding the devlink lock) to flush the wq without
> > deadlocking.
> > +	 */
> > +	while (!devl_trylock(devlink)) {
> > +		if (!esw->esw_funcs.notifier_enabled)
> 
> Technically READ_ONCE/WRITE_ONCE is required on this.

Will fix.


> > +			return;
> > +		schedule_timeout_interruptible(msecs_to_jiffies(10
> > ));
> 
> Why _interruptible(), you're not handling the return value.
> If somehow this thread gets a signal pending we'll turn this
> loop into a busy poll which doesn't seem ideal?


Didn't pay attention to this possibility. Sorry, will fix.

Cosmin.

Re: [PATCH net V2 2/4] net/mlx5: Fix deadlock between devlink lock and esw->wq

[Jakub Kicinski]

On Thu, 29 Jan 2026 10:33:40 +0000 Cosmin Ratiu wrote:
> > This is quite an ugly hack, is there no way to avoid the flush and
> > let 
> > the work discover that what it was supposed to do is no longer
> > needed?  
> 
> Not possible, unfortunately. I stared at it for quite a while. The wq
> is flushed because the esw is being unconfigured, which removes data
> structs the work handler uses. Flushing the work is required, otherwise
> we'll run into worse issues.

And having a refount on (I presume) struct mlx5_esw_functions
so that work can hold a ref is not an option?
Are you planning to revisit this in -next?

Re: [PATCH net V2 2/4] net/mlx5: Fix deadlock between devlink lock and esw->wq

[Cosmin Ratiu]

On Thu, 2026-01-29 at 15:40 -0800, Jakub Kicinski wrote:
> On Thu, 29 Jan 2026 10:33:40 +0000 Cosmin Ratiu wrote:
> > > This is quite an ugly hack, is there no way to avoid the flush
> > > and
> > > let 
> > > the work discover that what it was supposed to do is no longer
> > > needed?  
> > 
> > Not possible, unfortunately. I stared at it for quite a while. The
> > wq
> > is flushed because the esw is being unconfigured, which removes
> > data
> > structs the work handler uses. Flushing the work is required,
> > otherwise
> > we'll run into worse issues.
> 
> And having a refount on (I presume) struct mlx5_esw_functions
> so that work can hold a ref is not an option?
> Are you planning to revisit this in -next?

Currently, mlx5_eswitch_disable_locked (with the devlink lock held)
waits for esw_vfs_changed_event_handler to finish.
The event handler needs to acquire the same lock and load/unload all
VFs, which touches the entire esw.
I don't currently see how to use reference counting on the esw to avoid
waiting for the handler.

But we can have a deeper look as part of an internal task to improve
this. For now, please accept the V3 fix (about-to-be-sent) with the
current approach because we couldn't find a better way.

Cosmin.

Re: [PATCH net V2 2/4] net/mlx5: Fix deadlock between devlink lock and esw->wq

[Jakub Kicinski]

On Mon, 2 Feb 2026 14:48:28 +0000 Cosmin Ratiu wrote:
> > And having a refount on (I presume) struct mlx5_esw_functions
> > so that work can hold a ref is not an option?
> > Are you planning to revisit this in -next?  
> 
> Currently, mlx5_eswitch_disable_locked (with the devlink lock held)
> waits for esw_vfs_changed_event_handler to finish.
> The event handler needs to acquire the same lock and load/unload all
> VFs, which touches the entire esw.
> I don't currently see how to use reference counting on the esw to avoid
> waiting for the handler.

struct my_thing_with_work {
	work;
	refcount;
	dead;
};

work() {
	lock()
	if (my_thing->dead)
		goto out;
	/* .. add code here .. */
out:
	unlock()
	my_thing_put(my_thing)
}

some_op() {
	// assuming lock() held
	if (!work_queued(my_thing->work)) {
		refcount_inc(my_thing->refcount);
		queue_work(my_thing->work)
	}
}

shutdown_op() {
	// assuming lock() held
	if (cancel_work())
		my_thing_put(my_thing)

	my_thing->dead = true;
	my_thing_put(my_thing)
}

[PATCH net V2 3/4] net/mlx5: Fix vhca_id access call trace use before alloc

[Tariq Toukan]

From: Parav Pandit <parav@nvidia.com>

HCA CAP structure is allocated in mlx5_hca_caps_alloc().
mlx5_mdev_init()
  mlx5_hca_caps_alloc()

And HCA CAP is read from the device in mlx5_init_one().

The vhca_id's debugfs file is published even before above two
operations are done.
Due to this when user reads the vhca id before the initialization,
following call trace is observed.

Fix this by deferring debugfs publication until the HCA CAP is
allocated and read from the device.

BUG: kernel NULL pointer dereference, address: 0000000000000004
PGD 0 P4D 0
Oops: Oops: 0000 [#1] SMP PTI
CPU: 23 UID: 0 PID: 6605 Comm: cat Kdump: loaded Not tainted 6.18.0-rc7-sf+ #110 PREEMPT(full)
Hardware name: Supermicro SYS-6028U-TR4+/X10DRU-i+, BIOS 2.0b 08/09/2016
RIP: 0010:vhca_id_show+0x17/0x30 [mlx5_core]
Code: cb 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 48 8b 47 70 48 c7 c6 45 f0 12 c1 48 8b 80 70 03 00 00 <8b> 50 04 0f ca 0f b7 d2 e8 8c 82 47 cb 31 c0 c3 cc cc cc cc 0f 1f
RSP: 0018:ffffd37f4f337d40 EFLAGS: 00010203
RAX: 0000000000000000 RBX: ffff8f18445c9b40 RCX: 0000000000000001
RDX: ffff8f1109825180 RSI: ffffffffc112f045 RDI: ffff8f18445c9b40
RBP: 0000000000000000 R08: 0000645eac0d2928 R09: 0000000000000006
R10: ffffd37f4f337d48 R11: 0000000000000000 R12: ffffd37f4f337dd8
R13: ffffd37f4f337db0 R14: ffff8f18445c9b68 R15: 0000000000000001
FS:  00007f3eea099580(0000) GS:ffff8f2090f1f000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000004 CR3: 00000008b64e4006 CR4: 00000000003726f0
Call Trace:
 <TASK>
 seq_read_iter+0x11f/0x4f0
 ? _raw_spin_unlock+0x15/0x30
 ? do_anonymous_page+0x104/0x810
 seq_read+0xf6/0x120
 ? srso_alias_untrain_ret+0x1/0x10
 full_proxy_read+0x5c/0x90
 vfs_read+0xad/0x320
 ? handle_mm_fault+0x1ab/0x290
 ksys_read+0x52/0xd0
 do_syscall_64+0x61/0x11e0
 entry_SYSCALL_64_after_hwframe+0x76/0x7e

Fixes: dd3dd7263cde ("net/mlx5: Expose vhca_id to debugfs")
Signed-off-by: Parav Pandit <parav@nvidia.com>
Reviewed-by: Shay Drori <shayd@nvidia.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
---
 .../net/ethernet/mellanox/mlx5/core/debugfs.c    | 16 ++++++++++++++++
 drivers/net/ethernet/mellanox/mlx5/core/main.c   | 14 +++-----------
 .../net/ethernet/mellanox/mlx5/core/mlx5_core.h  |  1 +
 .../ethernet/mellanox/mlx5/core/sf/dev/driver.c  |  1 +
 4 files changed, 21 insertions(+), 11 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/debugfs.c b/drivers/net/ethernet/mellanox/mlx5/core/debugfs.c
index 36806e813c33..1301c56e20d6 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/debugfs.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/debugfs.c
@@ -613,3 +613,19 @@ void mlx5_debug_cq_remove(struct mlx5_core_dev *dev, struct mlx5_core_cq *cq)
 		cq->dbg = NULL;
 	}
 }
+
+static int vhca_id_show(struct seq_file *file, void *priv)
+{
+	struct mlx5_core_dev *dev = file->private;
+
+	seq_printf(file, "0x%x\n", MLX5_CAP_GEN(dev, vhca_id));
+	return 0;
+}
+
+DEFINE_SHOW_ATTRIBUTE(vhca_id);
+
+void mlx5_vhca_debugfs_init(struct mlx5_core_dev *dev)
+{
+	debugfs_create_file("vhca_id", 0400, dev->priv.dbg.dbg_root, dev,
+			    &vhca_id_fops);
+}
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index 4209da722f9a..55b4e0cceae2 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -1806,16 +1806,6 @@ static int mlx5_hca_caps_alloc(struct mlx5_core_dev *dev)
 	return -ENOMEM;
 }
 
-static int vhca_id_show(struct seq_file *file, void *priv)
-{
-	struct mlx5_core_dev *dev = file->private;
-
-	seq_printf(file, "0x%x\n", MLX5_CAP_GEN(dev, vhca_id));
-	return 0;
-}
-
-DEFINE_SHOW_ATTRIBUTE(vhca_id);
-
 static int mlx5_notifiers_init(struct mlx5_core_dev *dev)
 {
 	int err;
@@ -1884,7 +1874,7 @@ int mlx5_mdev_init(struct mlx5_core_dev *dev, int profile_idx)
 	priv->numa_node = dev_to_node(mlx5_core_dma_dev(dev));
 	priv->dbg.dbg_root = debugfs_create_dir(dev_name(dev->device),
 						mlx5_debugfs_root);
-	debugfs_create_file("vhca_id", 0400, priv->dbg.dbg_root, dev, &vhca_id_fops);
+
 	INIT_LIST_HEAD(&priv->traps);
 
 	err = mlx5_cmd_init(dev);
@@ -2022,6 +2012,8 @@ static int probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
 		goto err_init_one;
 	}
 
+	mlx5_vhca_debugfs_init(dev);
+
 	pci_save_state(pdev);
 	return 0;
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h
index cfebc110c02f..6d41d2e5a278 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h
@@ -258,6 +258,7 @@ int mlx5_wait_for_pages(struct mlx5_core_dev *dev, int *pages);
 void mlx5_cmd_flush(struct mlx5_core_dev *dev);
 void mlx5_cq_debugfs_init(struct mlx5_core_dev *dev);
 void mlx5_cq_debugfs_cleanup(struct mlx5_core_dev *dev);
+void mlx5_vhca_debugfs_init(struct mlx5_core_dev *dev);
 
 int mlx5_query_pcam_reg(struct mlx5_core_dev *dev, u32 *pcam, u8 feature_group,
 			u8 access_reg_group);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/driver.c b/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/driver.c
index b706f1486504..c45540fe7d9d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/driver.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/driver.c
@@ -76,6 +76,7 @@ static int mlx5_sf_dev_probe(struct auxiliary_device *adev, const struct auxilia
 		goto init_one_err;
 	}
 
+	mlx5_vhca_debugfs_init(mdev);
 	return 0;
 
 init_one_err:
-- 
2.40.1

[PATCH net V2 4/4] net/mlx5e: Skip ESN replay window setup for IPsec crypto offload

[Tariq Toukan]

From: Jianbo Liu <jianbol@nvidia.com>

Commit a5e400a985df ("net/mlx5e: Honor user choice of IPsec replay
window size") introduced logic to setup the ESN replay window size.
This logic is only valid for packet offload.

However, the check to skip this block only covered outbound offloads.
It was not skipped for crypto offload, causing it to fall through to
the new switch statement and trigger its WARN_ON default case (for
instance, if a window larger than 256 bits was configured).

Fix this by amending the condition to also skip the replay window
setup if the offload type is not XFRM_DEV_OFFLOAD_PACKET.

Fixes: a5e400a985df ("net/mlx5e: Honor user choice of IPsec replay window size")
Signed-off-by: Jianbo Liu <jianbol@nvidia.com>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
---
 drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
index a8fb4bec369c..9c7064187ed0 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
@@ -430,7 +430,8 @@ void mlx5e_ipsec_build_accel_xfrm_attrs(struct mlx5e_ipsec_sa_entry *sa_entry,
 		attrs->replay_esn.esn = sa_entry->esn_state.esn;
 		attrs->replay_esn.esn_msb = sa_entry->esn_state.esn_msb;
 		attrs->replay_esn.overlap = sa_entry->esn_state.overlap;
-		if (attrs->dir == XFRM_DEV_OFFLOAD_OUT)
+		if (attrs->dir == XFRM_DEV_OFFLOAD_OUT ||
+		    x->xso.type != XFRM_DEV_OFFLOAD_PACKET)
 			goto skip_replay_window;
 
 		switch (x->replay_esn->replay_window) {
-- 
2.40.1

Re: [PATCH net V2 0/4] mlx5 misc fixes 2026-01-27

[patchwork-bot+netdevbpf]

Hello:

This series was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Tue, 27 Jan 2026 10:52:37 +0200 you wrote:
> Hi,
> 
> This patchset provides misc bug fixes from the team to the mlx5 core and
> Eth drivers.
> 
> Thanks,
> Tariq.
> 
> [...]

Here is the summary with links:
  - [net,V2,1/4] net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect
    https://git.kernel.org/netdev/net/c/2610a3d65691
  - [net,V2,2/4] net/mlx5: Fix deadlock between devlink lock and esw->wq
    (no matching commit)
  - [net,V2,3/4] net/mlx5: Fix vhca_id access call trace use before alloc
    https://git.kernel.org/netdev/net/c/a8f930b7be7b
  - [net,V2,4/4] net/mlx5e: Skip ESN replay window setup for IPsec crypto offload
    https://git.kernel.org/netdev/net/c/011be342dd24

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html