xfrm: Clear RX SKB secpath xfrm_offload
authorIlan Tayari <ilant@mellanox.com>
Tue, 1 Aug 2017 09:49:09 +0000 (12:49 +0300)
committerSteffen Klassert <steffen.klassert@secunet.com>
Wed, 2 Aug 2017 09:00:15 +0000 (11:00 +0200)
commit7e9e9202bccc3a8224ae10ad5d69cac8627f9c7b
tree690049e1215a69ab23f1bd89e3b06cad6ac6a121
parentffdb5211da1c20354f1b40c204b6cf6c29c68161
xfrm: Clear RX SKB secpath xfrm_offload

If an incoming packet undergoes XFRM crypto-offload, its secpath is
filled with xfrm_offload struct denoting offload information.

If the SKB is then forwarded to a device which supports crypto-
offload, the stack wrongfully attempts to offload it (even though
the output SA may not exist on the device) due to the leftover
secpath xo.

Clear the ingress xo by zeroizing secpath->olen just before
delivering the decapsulated packet to the network stack.

Fixes: d77e38e612a0 ("xfrm: Add an IPsec hardware offloading API")
Signed-off-by: Ilan Tayari <ilant@mellanox.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
net/xfrm/xfrm_input.c