Re: [PATCH net] net/mlx5e: fix swapped IPv6 IPsec policy masks

[Tariq Toukan <tariqt@nvidia.com>]

On 17/09/2026 14:55, Andrea Parri wrote:
> IPv6 XFRM policies may use different source and destination prefix
> lengths. mlx5e_ipsec_policy_mask() builds the corresponding masks
> independently, but setup_fte_addr6() installs each mask in the opposite
> address field.
> 
> When the prefix lengths differ, this makes the source match use the
> destination prefix and the destination match use the source prefix. The
> resulting hardware rule can both miss traffic covered by the policy and
> match traffic outside it.
> 
> Install each mask in its corresponding match field.
> 
> Fixes: ca7992f52c2c ("net/mlx5e: Properly match IPsec subnet addresses")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Andrea Parri <parri.andrea@gmail.com>
> ---
>   drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c
> index 329608c59313b..8ffa8068e90ac 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c
> @@ -1564,14 +1564,14 @@ static void setup_fte_addr6(struct mlx5_flow_spec *spec,
>   		memcpy(MLX5_ADDR_OF(fte_match_param, spec->match_value,
>   				    outer_headers.src_ipv4_src_ipv6.ipv6_layout.ipv6), saddr, 16);
>   		memcpy(MLX5_ADDR_OF(fte_match_param, spec->match_criteria,
> -				    outer_headers.src_ipv4_src_ipv6.ipv6_layout.ipv6), dmask, 16);
> +				    outer_headers.src_ipv4_src_ipv6.ipv6_layout.ipv6), smask, 16);
>   	}
>   
>   	if (!addr6_all_zero(daddr)) {
>   		memcpy(MLX5_ADDR_OF(fte_match_param, spec->match_value,
>   				    outer_headers.dst_ipv4_dst_ipv6.ipv6_layout.ipv6), daddr, 16);
>   		memcpy(MLX5_ADDR_OF(fte_match_param, spec->match_criteria,
> -				    outer_headers.dst_ipv4_dst_ipv6.ipv6_layout.ipv6), smask, 16);
> +				    outer_headers.dst_ipv4_dst_ipv6.ipv6_layout.ipv6), dmask, 16);
>   	}
>   }
>   

Thanks for your patch.

Reviewed-by: Tariq Toukan <tariqt@nvidia.com>