netdev - Re: [PATCH ipsec] xfrm: ipcomp: adjust transport header after decompressing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aFtb6bNxShhfDuzi@gondor.apana.org.au>
Date: Wed, 25 Jun 2025 10:16:09 +0800
From: Herbert Xu <herbert@...dor.apana.org.au>
To: Fernando Fernandez Mancera <fmancera@...e.de>
Cc: netdev@...r.kernel.org, steffen.klassert@...unet.com
Subject: Re: [PATCH ipsec] xfrm: ipcomp: adjust transport header after
 decompressing

On Tue, Jun 24, 2025 at 03:11:15PM +0200, Fernando Fernandez Mancera wrote:
> The skb transport header pointer needs to be adjusted by network header
> pointer plus the size of the ipcomp header.
> 
> This shows up when running traffic over ipcomp using transport mode.
> After being reinjected, packets are dropped because the header isn't
> adjusted properly and some checks can be triggered. E.g the skb is
> mistakenly considered as IP fragmented packet and later dropped.
> 
> kworker/30:1-mm     443 [030]   102.055250:     skb:kfree_skb:skbaddr=0xffff8f104aa3ce00 rx_sk=(
>         ffffffff8419f1f4 sk_skb_reason_drop+0x94 ([kernel.kallsyms])
>         ffffffff8419f1f4 sk_skb_reason_drop+0x94 ([kernel.kallsyms])
>         ffffffff84281420 ip_defrag+0x4b0 ([kernel.kallsyms])
>         ffffffff8428006e ip_local_deliver+0x4e ([kernel.kallsyms])
>         ffffffff8432afb1 xfrm_trans_reinject+0xe1 ([kernel.kallsyms])
>         ffffffff83758230 process_one_work+0x190 ([kernel.kallsyms])
>         ffffffff83758f37 worker_thread+0x2d7 ([kernel.kallsyms])
>         ffffffff83761cc9 kthread+0xf9 ([kernel.kallsyms])
>         ffffffff836c3437 ret_from_fork+0x197 ([kernel.kallsyms])
>         ffffffff836718da ret_from_fork_asm+0x1a ([kernel.kallsyms])
> 
> Fixes: eb2953d26971 ("xfrm: ipcomp: Use crypto_acomp interface")
> Link: https://bugzilla.suse.com/1244532
> Signed-off-by: Fernando Fernandez Mancera <fmancera@...e.de>
> ---
>  net/xfrm/xfrm_ipcomp.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Acked-by: Herbert Xu <herbert@...dor.apana.org.au>

Thanks for catching this.
-- 
Email: Herbert Xu <herbert@...dor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt