netdev - Re: [net] ixgbevf: Fix secpath usage for IPsec Tx offload

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <15ee31e8-11e7-59e4-97ae-75f3fe6daa89@pensando.io>
Date:   Thu, 12 Sep 2019 23:26:45 +0100
From:   Shannon Nelson <snelson@...sando.io>
To:     Jeff Kirsher <jeffrey.t.kirsher@...el.com>, netdev@...r.kernel.org
Cc:     Jonathan Tooker <jonathan@...iablehosting.com>
Subject: Re: [net] ixgbevf: Fix secpath usage for IPsec Tx offload

On 9/12/19 8:07 PM, Jeff Kirsher wrote:
> Port the same fix for ixgbe to ixgbevf.
>
> The ixgbevf driver currently does IPsec Tx offloading
> based on an existing secpath. However, the secpath
> can also come from the Rx side, in this case it is
> misinterpreted for Tx offload and the packets are
> dropped with a "bad sa_idx" error. Fix this by using
> the xfrm_offload() function to test for Tx offload.
>
> CC: Shannon Nelson <snelson@...sando.io>
> Fixes: 7f68d4306701 ("ixgbevf: enable VF IPsec offload operations")
> Reported-by: Jonathan Tooker <jonathan@...iablehosting.com>
> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@...el.com>
> ---
>   drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
> index d2b41f9f87f8..72872d6ca80c 100644
> --- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
> +++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
> @@ -30,6 +30,7 @@
>   #include <linux/bpf.h>
>   #include <linux/bpf_trace.h>
>   #include <linux/atomic.h>
> +#include <net/xfrm.h>
>   
>   #include "ixgbevf.h"
>   
> @@ -4161,7 +4162,7 @@ static int ixgbevf_xmit_frame_ring(struct sk_buff *skb,
>   	first->protocol = vlan_get_protocol(skb);
>   
>   #ifdef CONFIG_IXGBEVF_IPSEC
> -	if (secpath_exists(skb) && !ixgbevf_ipsec_tx(tx_ring, first, &ipsec_tx))
> +	if (xfrm_offload(skb) && !ixgbevf_ipsec_tx(tx_ring, first, &ipsec_tx))
>   		goto out_drop;
>   #endif
>   	tso = ixgbevf_tso(tx_ring, first, &hdr_len, &ipsec_tx);

Acked-by: Shannon Nelson <snelson@...sando.io>