Commit 73b9fc49 authored Oct 30, 2017 by Steffen Klassert

xfrm: Fix GSO for IPsec with GRE tunnel.



We reset the encapsulation field of the skb too early
in xfrm_output. As a result, the GRE GSO handler does
not segment the packets. This leads to a performance
drop down. We fix this by resetting the encapsulation
field right before we do the transformation, when
the inner headers become invalid.

Fixes: f1bd7d65 ("xfrm: Add encapsulation header offsets while SKB is not encrypted")
Reported-by: Vicente De Luca <vdeluca@zendesk.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>

parent 2b06cdf3

net/xfrm/xfrm_output.c

+3 −1

Original line number	Diff line number	Diff line
		@@ -105,6 +105,9 @@ static int xfrm_output_one(struct sk_buff *skb, int err)
		if (xfrm_offload(skb)) {
		x->type_offload->encap(x, skb);
		} else {
		/* Inner headers are invalid now. */
		skb->encapsulation = 0;

		err = x->type->output(x, skb);
		if (err == -EINPROGRESS)
		goto out;
		@@ -208,7 +211,6 @@ int xfrm_output(struct sock sk, struct sk_buff skb)
		int err;

		secpath_reset(skb);
		skb->encapsulation = 0;

		if (xfrm_dev_offload_ok(skb, x)) {
		struct sec_path *sp;

Admin message