netdev - Re: [PATCH net] xfrm: Linearize the skb after offloading if needed.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <ZJA4jFWxAs19rXK2@gauss3.secunet.de>
Date: Mon, 19 Jun 2023 13:14:20 +0200
From: Steffen Klassert <steffen.klassert@...unet.com>
To: Sebastian Andrzej Siewior <bigeasy@...utronix.de>
CC: <netdev@...r.kernel.org>, "David S. Miller" <davem@...emloft.net>, "David
 Ahern" <dsahern@...nel.org>, Eric Dumazet <edumazet@...gle.com>, Herbert Xu
	<herbert@...dor.apana.org.au>, Jakub Kicinski <kuba@...nel.org>, Paolo Abeni
	<pabeni@...hat.com>, Thomas Gleixner <tglx@...utronix.de>
Subject: Re: [PATCH net] xfrm: Linearize the skb after offloading if needed.

On Wed, Jun 14, 2023 at 12:02:02PM +0200, Sebastian Andrzej Siewior wrote:
> With offloading enabled, esp_xmit() gets invoked very late, from within
> validate_xmit_xfrm() which is after validate_xmit_skb() validates and
> linearizes the skb if the underlying device does not support fragments.
> 
> esp_output_tail() may add a fragment to the skb while adding the auth
> tag/ IV. Devices without the proper support will then send skb->data
> points to with the correct length so the packet will have garbage at the
> end. A pcap sniffer will claim that the proper data has been sent since
> it parses the skb properly.
> 
> It is not affected with INET_ESP_OFFLOAD disabled.
> 
> Linearize the skb after offloading if the sending hardware requires it.
> It was tested on v4, v6 has been adopted.
> 
> Fixes: 7785bba299a8d ("esp: Add a software GRO codepath")
> Signed-off-by: Sebastian Andrzej Siewior <bigeasy@...utronix.de>

Applied to the ipsec tree, thanks a lot!