Re: Regression Linux 6.18.22: ipsec stops working: reason: commit 153d5520c3f9 "crypto: authencesn - Do not place hiseq at end of dst for out-of-place d.cryption"

Wolfgang Walter
2026-04-14T17:41:42Z

Am 2026-04-14 18:58, schrieb Sasha Levin:
> On Tue, Apr 14, 2026 at 06:52:22PM +0200, Wolfgang Walter wrote:
>> Hello,
>>
>> with 6.12.18 ipsec stopped working for us. After reverting commit
>>
>> commit 153d5520c3f9fd62e71c7e7f9e34b59cf411e555.
>> Author: Herbert Xu <herbert@gondor.apana.org.au>
>> Date: Fri Mar 27 15:04:17 2026 +0900
>>
>> crypto: authencesn - Do not place hiseq at end of dst for
>> out-of-place decryption
>>
>> [ Upstream commit e02494114ebf7c8b42777c6cd6982f113bfdbec7 ]
>>
>> When decrypting data that is not in-place (src != dst), there is
>> no need to save the high-order sequence bits in dst as it could
>> simply be re-copied from the source.
>>
>> However, the data to be hashed need to be rearranged accordingly.
>>
>> Reported-by: Taeyang Lee <0wn@theori.io>
>> Fixes: 104880a6b470 ("crypto: authencesn - Convert to new AEAD
>> interface")
>> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
>>
>> Thanks,
>>
>> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
>> Signed-off-by: Sasha Levin <sashal@kernel.org>
>>
>>
>> ipsec worked again. We use esn here.
>
> Thanks for the report!
>
> Could you please check if you see the issue with mainline?

Same problem with mainline: v7.0 brakes ipsec here.

Regards,
--
Wolfgang Walter
Studierendenwerk München Oberbayern
Anstalt des öffentlichen Rechts