Merge tag 'ipsec-next-2025-05-23' of git://git.kernel.org/pub/scm/linux/kernel/git...

Steffen Klassert says:

====================
1) Remove some unnecessary strscpy_pad() size arguments.
   From Thorsten Blum.

2) Correct use of xso.real_dev on bonding offloads.
   Patchset from Cosmin Ratiu.

3) Add hardware offload configuration to XFRM_MSG_MIGRATE.
   From Chiachang Wang.

4) Refactor migration setup during cloning. This was
   done after the clone was created. Now it is done
   in the cloning function itself.
   From Chiachang Wang.

5) Validate assignment of maximal possible SEQ number.
   Prevent from setting to the maximum sequrnce number
   as this would cause for traffic drop.
   From Leon Romanovsky.

6) Prevent configuration of interface index when offload
   is used. Hardware can't handle this case.i
   From Leon Romanovsky.

7) Always use kfree_sensitive() for SA secret zeroization.
   From Zilin Guan.

ipsec-next-2025-05-23

* tag 'ipsec-next-2025-05-23' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next:
  xfrm: use kfree_sensitive() for SA secret zeroization
  xfrm: prevent configuration of interface index when offload is used
  xfrm: validate assignment of maximal possible SEQ number
  xfrm: Refactor migration setup during the cloning process
  xfrm: Migrate offload configuration
  bonding: Fix multiple long standing offload races
  bonding: Mark active offloaded xfrm_states
  xfrm: Add explicit dev to .xdo_dev_state_{add,delete,free}
  xfrm: Remove unneeded device check from validate_xmit_xfrm
  xfrm: Use xdo.dev instead of xdo.real_dev
  net/mlx5: Avoid using xso.real_dev unnecessarily
  xfrm: Remove unnecessary strscpy_pad() size arguments
====================

Link: https://patch.msgid.link/20250523075611.3723340-1-steffen.klassert@secunet.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

diff --cc drivers/net/bonding/bond_main.c
Simple merge

diff --cc drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
index 648a7c6,796e90d..d1f4073
--- 1/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
--- 2/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
@@@ -473,12 -474,13 +474,13 @@@ static int ixgbe_ipsec_parse_proto_keys
  
  /**
   * ixgbe_ipsec_check_mgmt_ip - make sure there is no clash with mgmt IP filters
+  * @dev: pointer to net device
   * @xs: pointer to transformer state struct
   **/
- static int ixgbe_ipsec_check_mgmt_ip(struct xfrm_state *xs)
+ static int ixgbe_ipsec_check_mgmt_ip(struct net_device *dev,
+                                    struct xfrm_state *xs)
  {
-       struct net_device *dev = xs->xso.real_dev;
 -      struct ixgbe_adapter *adapter = netdev_priv(dev);
 +      struct ixgbe_adapter *adapter = ixgbe_from_netdev(dev);
        struct ixgbe_hw *hw = &adapter->hw;
        u32 mfval, manc, reg;
        int num_filters = 4;
@@@ -559,11 -562,11 +562,11 @@@
   * @xs: pointer to transformer state struct
   * @extack: extack point to fill failure reason
   **/
- static int ixgbe_ipsec_add_sa(struct xfrm_state *xs,
+ static int ixgbe_ipsec_add_sa(struct net_device *dev,
+                             struct xfrm_state *xs,
                              struct netlink_ext_ack *extack)
  {
-       struct net_device *dev = xs->xso.real_dev;
 -      struct ixgbe_adapter *adapter = netdev_priv(dev);
 +      struct ixgbe_adapter *adapter = ixgbe_from_netdev(dev);
        struct ixgbe_ipsec *ipsec = adapter->ipsec;
        struct ixgbe_hw *hw = &adapter->hw;
        int checked, match, first;
@@@ -752,12 -755,12 +755,12 @@@
  
  /**
   * ixgbe_ipsec_del_sa - clear out this specific SA
+  * @dev: pointer to device to program
   * @xs: pointer to transformer state struct
   **/
- static void ixgbe_ipsec_del_sa(struct xfrm_state *xs)
+ static void ixgbe_ipsec_del_sa(struct net_device *dev, struct xfrm_state *xs)
  {
-       struct net_device *dev = xs->xso.real_dev;
 -      struct ixgbe_adapter *adapter = netdev_priv(dev);
 +      struct ixgbe_adapter *adapter = ixgbe_from_netdev(dev);
        struct ixgbe_ipsec *ipsec = adapter->ipsec;
        struct ixgbe_hw *hw = &adapter->hw;
        u32 zerobuf[4] = {0, 0, 0, 0};

diff --cc include/linux/netdevice.h
Simple merge

diff --cc include/net/xfrm.h
Simple merge

diff --cc net/xfrm/xfrm_policy.c
Simple merge

diff --cc net/xfrm/xfrm_state.c
Simple merge