Re: [PATCH] net/mlx5e: Do not increment ESN when updating IPsec ESN state

[Leon Romanovsky <leon@kernel.org>]

On Sun, Aug 21, 2022 at 10:25:51PM -0700, Hyong Youb Kim wrote:
> An offloaded SA stops receiving after about 2^32 + replay_window
> packets. For example, when SA reaches <seq-hi 0x1, seq 0x2c>, all
> subsequent packets get dropped with SA-icv-failure (integrity_failed).
> 
> To reproduce the bug:
> - ConnectX-6 Dx with crypto enabled (FW 22.30.1004)
> - ipsec.conf:
>   nic-offload = yes
>   replay-window = 32
>   esn = yes
>   salifetime=24h
> - Run netperf for a long time to send more than 2^32 packets
>   netperf -H <device-under-test> -t TCP_STREAM -l 20000
> 
> When 2^32 + replay_window packets are received, the replay window
> moves from the 2nd half of subspace (overlap=1) to the 1st half
> (overlap=0). The driver then updates the 'esn' value in NIC
> (i.e. seq_hi) as follows.
> 
>  seq_hi = xfrm_replay_seqhi(seq_bottom)
>  new esn in NIC = seq_hi + 1
> 
> The +1 increment is wrong, as seq_hi already contains the correct
> seq_hi. For example, when seq_hi=1, the driver actually tells NIC to
> use seq_hi=2 (esn). This incorrect esn value causes all subsequent
> packets to fail integrity checks (SA-icv-failure). So, do not
> increment.
> 
> Fixes: cb01008390bb ("net/mlx5: IPSec, Add support for ESN")
> Signed-off-by: Hyong Youb Kim <hyonkim@cisco.com>
> ---
>  drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c | 3 ---
>  1 file changed, 3 deletions(-)
> 

Thanks,
Acked-by: Leon Romanovsky <leonro@nvidia.com>