From: "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com>
To: "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"stable@vger.kernel.org" <stable@vger.kernel.org>
Cc: Ansis Atteka <aatteka@ovn.org>,
"David S . Miller" <davem@davemloft.net>,
"Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com>
Subject: [PATCH for 4.9 05/39] udp: disable inner UDP checksum offloads in IPsec case
Date: Mon, 18 Sep 2017 00:19:38 +0000 [thread overview]
Message-ID: <20170918001922.7048-5-alexander.levin@verizon.com> (raw)
In-Reply-To: <20170918001922.7048-1-alexander.levin@verizon.com>
From: Ansis Atteka <aatteka@ovn.org>
[ Upstream commit b40c5f4fde22fb98eff205b3aece05b471c24eed ]
Otherwise, UDP checksum offloads could corrupt ESP packets by attempting
to calculate UDP checksum when this inner UDP packet is already protected
by IPsec.
One way to reproduce this bug is to have a VM with virtio_net driver (UFO
set to ON in the guest VM); and then encapsulate all guest's Ethernet
frames in Geneve; and then further encrypt Geneve with IPsec. In this
case following symptoms are observed:
1. If using ixgbe NIC, then it will complain with following error message:
ixgbe 0000:01:00.1: partial checksum but l4 proto=32!
2. Receiving IPsec stack will drop all the corrupted ESP packets and
increase XfrmInStateProtoError counter in /proc/net/xfrm_stat.
3. iperf UDP test from the VM with packet sizes above MTU will not work at
all.
4. iperf TCP test from the VM will get ridiculously low performance because.
Signed-off-by: Ansis Atteka <aatteka@ovn.org>
Co-authored-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
---
net/ipv4/udp_offload.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
index 6de016f80f17..0932c85b42af 100644
--- a/net/ipv4/udp_offload.c
+++ b/net/ipv4/udp_offload.c
@@ -29,6 +29,7 @@ static struct sk_buff *__skb_udp_tunnel_segment(struct sk_buff *skb,
u16 mac_len = skb->mac_len;
int udp_offset, outer_hlen;
__wsum partial;
+ bool need_ipsec;
if (unlikely(!pskb_may_pull(skb, tnl_hlen)))
goto out;
@@ -62,8 +63,10 @@ static struct sk_buff *__skb_udp_tunnel_segment(struct sk_buff *skb,
ufo = !!(skb_shinfo(skb)->gso_type & SKB_GSO_UDP);
+ need_ipsec = skb_dst(skb) && dst_xfrm(skb_dst(skb));
/* Try to offload checksum if possible */
offload_csum = !!(need_csum &&
+ !need_ipsec &&
(skb->dev->features &
(is_ipv6 ? (NETIF_F_HW_CSUM | NETIF_F_IPV6_CSUM) :
(NETIF_F_HW_CSUM | NETIF_F_IP_CSUM))));
--
2.11.0
next prev parent reply other threads:[~2017-09-18 0:22 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-09-18 0:19 [PATCH for 4.9 01/39] net: core: Prevent from dereferencing null pointer when releasing SKB Levin, Alexander (Sasha Levin)
2017-09-18 0:19 ` [PATCH for 4.9 02/39] net/packet: check length in getsockopt() called with PACKET_HDRLEN Levin, Alexander (Sasha Levin)
2017-09-18 0:19 ` [PATCH for 4.9 03/39] team: fix memory leaks Levin, Alexander (Sasha Levin)
2017-09-18 0:19 ` [PATCH for 4.9 04/39] usb: plusb: Add support for PL-27A1 Levin, Alexander (Sasha Levin)
2017-09-18 0:19 ` [PATCH for 4.9 09/39] bridge: netlink: register netdevice before executing changelink Levin, Alexander (Sasha Levin)
2017-09-18 0:19 ` [PATCH for 4.9 08/39] mmc: sdio: fix alignment issue in struct sdio_func Levin, Alexander (Sasha Levin)
2017-09-18 0:19 ` Levin, Alexander (Sasha Levin) [this message]
2017-09-18 0:19 ` [PATCH for 4.9 06/39] net: dsa: b53: Include IMP/CPU port in dumb forwarding mode Levin, Alexander (Sasha Levin)
2017-09-18 0:19 ` [PATCH for 4.9 07/39] qed: Fix possible system hang in the dcbnl-getdcbx() path Levin, Alexander (Sasha Levin)
2017-09-18 0:19 ` [PATCH for 4.9 12/39] sata_via: Enable hotplug only on VT6421 Levin, Alexander (Sasha Levin)
2017-09-18 0:19 ` [PATCH for 4.9 10/39] Btrfs: fix segmentation fault when doing dio read Levin, Alexander (Sasha Levin)
2017-09-18 0:19 ` [PATCH for 4.9 11/39] Btrfs: fix potential use-after-free for cloned bio Levin, Alexander (Sasha Levin)
2017-09-18 0:19 ` [PATCH for 4.9 13/39] hugetlbfs: initialize shared policy as part of inode allocation Levin, Alexander (Sasha Levin)
2017-09-18 0:19 ` [PATCH for 4.9 14/39] kasan: do not sanitize kexec purgatory Levin, Alexander (Sasha Levin)
2017-09-18 0:19 ` [PATCH for 4.9 15/39] drivers/rapidio/devices/tsi721.c: make module parameter variable name unique Levin, Alexander (Sasha Levin)
2017-09-18 0:19 ` [PATCH for 4.9 16/39] netfilter: invoke synchronize_rcu after set the _hook_ to NULL Levin, Alexander (Sasha Levin)
2017-09-18 0:19 ` [PATCH for 4.9 17/39] MIPS: IRQ Stack: Unwind IRQ stack onto task stack Levin, Alexander (Sasha Levin)
2017-09-18 6:41 ` [PATCH for 4.9 01/39] net: core: Prevent from dereferencing null pointer when releasing SKB Greg KH
2017-09-18 14:13 ` Levin, Alexander (Sasha Levin)
2017-09-18 14:31 ` Levin, Alexander (Sasha Levin)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170918001922.7048-5-alexander.levin@verizon.com \
--to=alexander.levin@verizon.com \
--cc=aatteka@ovn.org \
--cc=davem@davemloft.net \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®