Subject: Re: [PATCH net-next] xfrm: fix xfrm_dev_offload_ok() returning true for software SAs

From: Sabrina Dubroca <[email-masked]>
Date: Wed, 27 May 2026 18:01:49 +0200

2026-05-27, 16:09:48 +0200, Petr Wozniak wrote:
> xfrm_dev_offload_ok() reaches the ok: label when the SA has no
> offload device (dev == NULL, SW SA) because the guard condition
> "(!dev || dev == xfrm_dst_path(dst)->dev)" evaluates true for
> dev == NULL.  The explicit "if (!dev) return true" at ok: then
> incorrectly routes the SW SA onto the GSO offload path.

Incorrectly? IPsec in SW with GSO is a valid setup. I think you're
breaking that with your patch.

-- 
Sabrina