| Message ID | 20230614100202.1-YtK7H5@linutronix.de (mailing list archive) |
|---|---|
| State | Awaiting Upstream |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] xfrm: Linearize the skb after offloading if needed. | expand |
On Wed, Jun 14, 2023 at 12:02:02PM +0200, Sebastian Andrzej Siewior wrote: > With offloading enabled, esp_xmit() gets invoked very late, from within > validate_xmit_xfrm() which is after validate_xmit_skb() validates and > linearizes the skb if the underlying device does not support fragments. > > esp_output_tail() may add a fragment to the skb while adding the auth > tag/ IV. Devices without the proper support will then send skb->data > points to with the correct length so the packet will have garbage at the > end. A pcap sniffer will claim that the proper data has been sent since > it parses the skb properly. > > It is not affected with INET_ESP_OFFLOAD disabled. > > Linearize the skb after offloading if the sending hardware requires it. > It was tested on v4, v6 has been adopted. > > Fixes: 7785bba299a8d ("esp: Add a software GRO codepath") > Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Applied to the ipsec tree, thanks a lot!
diff --git a/net/ipv4/esp4_offload.c b/net/ipv4/esp4_offload.c index 3969fa805679c..ee848be59e65a 100644 --- a/net/ipv4/esp4_offload.c +++ b/net/ipv4/esp4_offload.c @@ -340,6 +340,9 @@ static int esp_xmit(struct xfrm_state *x, struct sk_buff *skb, netdev_features_ secpath_reset(skb); + if (skb_needs_linearize(skb, skb->dev->features) && + __skb_linearize(skb)) + return -ENOMEM; return 0; } diff --git a/net/ipv6/esp6_offload.c b/net/ipv6/esp6_offload.c index 75c02992c520f..7723402689973 100644 --- a/net/ipv6/esp6_offload.c +++ b/net/ipv6/esp6_offload.c @@ -374,6 +374,9 @@ static int esp6_xmit(struct xfrm_state *x, struct sk_buff *skb, netdev_features secpath_reset(skb); + if (skb_needs_linearize(skb, skb->dev->features) && + __skb_linearize(skb)) + return -ENOMEM; return 0; }
With offloading enabled, esp_xmit() gets invoked very late, from within validate_xmit_xfrm() which is after validate_xmit_skb() validates and linearizes the skb if the underlying device does not support fragments. esp_output_tail() may add a fragment to the skb while adding the auth tag/ IV. Devices without the proper support will then send skb->data points to with the correct length so the packet will have garbage at the end. A pcap sniffer will claim that the proper data has been sent since it parses the skb properly. It is not affected with INET_ESP_OFFLOAD disabled. Linearize the skb after offloading if the sending hardware requires it. It was tested on v4, v6 has been adopted. Fixes: 7785bba299a8d ("esp: Add a software GRO codepath") Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> --- net/ipv4/esp4_offload.c | 3 +++ net/ipv6/esp6_offload.c | 3 +++ 2 files changed, 6 insertions(+)