Commit 7e9e9202 authored Aug 01, 2017 by Ilan Tayari Committed by Steffen Klassert Aug 02, 2017

xfrm: Clear RX SKB secpath xfrm_offload



If an incoming packet undergoes XFRM crypto-offload, its secpath is
filled with xfrm_offload struct denoting offload information.

If the SKB is then forwarded to a device which supports crypto-
offload, the stack wrongfully attempts to offload it (even though
the output SA may not exist on the device) due to the leftover
secpath xo.

Clear the ingress xo by zeroizing secpath->olen just before
delivering the decapsulated packet to the network stack.

Fixes: d77e38e6 ("xfrm: Add an IPsec hardware offloading API")
Signed-off-by: Ilan Tayari <ilant@mellanox.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>

parent ffdb5211

net/xfrm/xfrm_input.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -424,6 +424,7 @@ resume:
		nf_reset(skb);

		if (decaps) {
		skb->sp->olen = 0;
		skb_dst_drop(skb);
		gro_cells_receive(&gro_cells, skb);
		return 0;
		@@ -434,6 +435,7 @@ resume:

		err = x->inner_mode->afinfo->transport_finish(skb, xfrm_gro \|\| async);
		if (xfrm_gro) {
		skb->sp->olen = 0;
		skb_dst_drop(skb);
		gro_cells_receive(&gro_cells, skb);
		return err;

Admin message