Fwd: [PATCH] crypto: authencesn - Fix src offset when decrypting in-place

Wolfgang Walter
2026-04-22T09:30:20Z

Hello,

the fix from Herbert Xu has landed in Torvald's tree as:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1f48ad3b19a9dfc947868edda0bb8e48e5b5a8fa

Would it be possible to include it in the next stable releases? I using
it already for v6.18.22 and v6.18.23 and it fixes ipsec with esn.

-------- Originalnachricht --------
Betreff: [PATCH] crypto: authencesn - Fix src offset when decrypting
in-place
Datum: 2026-04-15 01:39
Von: Herbert Xu <herbert@gondor.apana.org.au>
An: Wolfgang Walter <linux@stwm.de>
Kopie: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
linux-kernel@vger.kernel.org, stable@vger.kernel.org, Sasha Levin
<sashal@kernel.org>, Linux Crypto Mailing List
<linux-crypto@vger.kernel.org>

On Tue, Apr 14, 2026 at 06:52:22PM +0200, Wolfgang Walter wrote:
> Hello,
>
> with 6.12.18 ipsec stopped working for us. After reverting commit
>
> commit 153d5520c3f9fd62e71c7e7f9e34b59cf411e555.
> Author: Herbert Xu <herbert@gondor.apana.org.au>
> Date: Fri Mar 27 15:04:17 2026 +0900
>
> crypto: authencesn - Do not place hiseq at end of dst for
> out-of-place
> decryption

Yes this is broken. Please try this patch:

---8<---
The src SG list offset wasn't set properly when decrypting in-place,
fix it.

Reported-by: Wolfgang Walter <linux@stwm.de>
Fixes: e02494114ebf ("crypto: authencesn - Do not place hiseq at end of
dst for out-of-place decryption")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

diff --git a/crypto/authencesn.c b/crypto/authencesn.c
index c0a01d738d9b..af3d584e584f 100644
--- a/crypto/authencesn.c
+++ b/crypto/authencesn.c
@@ -228,9 +228,11 @@ static int crypto_authenc_esn_decrypt_tail(struct
aead_request *req,

decrypt:

- if (src != dst)
- src = scatterwalk_ffwd(areq_ctx->src, src, assoclen);
dst = scatterwalk_ffwd(areq_ctx->dst, dst, assoclen);
+ if (req->src == req->dst)
+ src = dst;
+ else
+ src = scatterwalk_ffwd(areq_ctx->src, src, assoclen);

skcipher_request_set_tfm(skreq, ctx->enc);
skcipher_request_set_callback(skreq, flags,

Regards
--
Wolfgang Walter
Studierendenwerk München Oberbayern
Anstalt des öffentlichen Rechts