summaryrefslogtreecommitdiff
path: root/net/xfrm
diff options
context:
space:
mode:
authorIlan Tayari <ilant@mellanox.com>2017-08-01 12:49:09 +0300
committerSteffen Klassert <steffen.klassert@secunet.com>2017-08-02 12:00:15 +0300
commit7e9e9202bccc3a8224ae10ad5d69cac8627f9c7b (patch)
tree690049e1215a69ab23f1bd89e3b06cad6ac6a121 /net/xfrm
parentffdb5211da1c20354f1b40c204b6cf6c29c68161 (diff)
downloadlinux-7e9e9202bccc3a8224ae10ad5d69cac8627f9c7b.tar.xz
xfrm: Clear RX SKB secpath xfrm_offload
If an incoming packet undergoes XFRM crypto-offload, its secpath is filled with xfrm_offload struct denoting offload information. If the SKB is then forwarded to a device which supports crypto- offload, the stack wrongfully attempts to offload it (even though the output SA may not exist on the device) due to the leftover secpath xo. Clear the ingress xo by zeroizing secpath->olen just before delivering the decapsulated packet to the network stack. Fixes: d77e38e612a0 ("xfrm: Add an IPsec hardware offloading API") Signed-off-by: Ilan Tayari <ilant@mellanox.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Diffstat (limited to 'net/xfrm')
-rw-r--r--net/xfrm/xfrm_input.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index 923205e279f7..f07eec59dcae 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -424,6 +424,7 @@ resume:
nf_reset(skb);
if (decaps) {
+ skb->sp->olen = 0;
skb_dst_drop(skb);
gro_cells_receive(&gro_cells, skb);
return 0;
@@ -434,6 +435,7 @@ resume:
err = x->inner_mode->afinfo->transport_finish(skb, xfrm_gro || async);
if (xfrm_gro) {
+ skb->sp->olen = 0;
skb_dst_drop(skb);
gro_cells_receive(&gro_cells, skb);
return err;