qiurui
/
linux-kernelorg-stable
mirror of https://kernel.googlesource.com/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
1,381,531 Commits 112 Branches 5,466 Tags 9 GiB
C 97.3%
Assembly 1%
Shell 0.6%
Python 0.4%
Makefile 0.3%
Other 0.2%
Go to file
Sabrina Dubroca 91d8a53db2 xfrm: fix offloading of cross-family tunnels 
Xiumei reported a regression in IPsec offload tests over xfrmi, where
the traffic for IPv6 over IPv4 tunnels is processed in SW instead of
going through crypto offload, after commit
cc18f482e8 ("xfrm: provide common xdo_dev_offload_ok callback
implementation").

Commit cc18f482e8 added a generic version of existing checks
attempting to prevent packets with IPv4 options or IPv6 extension
headers from being sent to HW that doesn't support offloading such
packets. The check mistakenly uses x->props.family (the outer family)
to determine the inner packet's family and verify if
options/extensions are present.

In the case of IPv6 over IPv4, the check compares some of the traffic
class bits to the expected no-options ihl value (5). The original
check was introduced in commit 2ac9cfe782 ("net/mlx5e: IPSec, Add
Innova IPSec offload TX data path"), and then duplicated in the other
drivers. Before commit cc18f482e8, the loose check (ihl > 5) passed
because those traffic class bits were not set to a value that
triggered the no-offload codepath. Packets with options/extension
headers that should have been handled in SW went through the offload
path, and were likely dropped by the NIC or incorrectly
processed. Since commit cc18f482e8, the check is now strict (ihl !=
5), and in a basic setup (no traffic class configured), all packets go
through the no-offload codepath.

The commits that introduced the incorrect family checks in each driver
are:
2ac9cfe782 ("net/mlx5e: IPSec, Add Innova IPSec offload TX data path")
8362ea16f6 ("crypto: chcr - ESN for Inline IPSec Tx")
859a497fe8 ("nfp: implement xfrm callbacks and expose ipsec offload feature to upper layer")
32188be805 ("cn10k-ipsec: Allow ipsec crypto offload for skb with SA")
[ixgbe/ixgbevf commits are ignored, as that HW does not support tunnel
mode, thus no cross-family setups are possible]

Fixes: cc18f482e8 ("xfrm: provide common xdo_dev_offload_ok callback implementation")
Reported-by: Xiumei Mu <xmu@redhat.com>
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
 		2025-09-15 11:35:06 +02:00
Documentation docs: Fix name for net.ipv4.udp_child_hash_entries 2025-08-12 13:03:13 +02:00
LICENSES
…
arch riscv: dts: thead: Add APB clocks for TH1520 GMACs 2025-08-12 12:52:21 +02:00
block
…
certs
…
crypto
…
drivers Merge branch '10GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue 2025-08-13 17:31:46 -07:00
fs for-6.17-fix-tag 2025-08-06 15:52:56 +03:00
include net: kcm: Fix race condition in kcm_unattach() 2025-08-13 18:18:33 -07:00
init
…
io_uring
…
ipc
…
kernel ipvs: Fix estimator kthreads preferred affinity 2025-08-13 08:34:33 +02:00
lib ref_tracker: use %p instead of %px in debugfs dentry name 2025-08-11 20:07:44 -07:00
mm Significant patch series in this pull request: 2025-08-05 16:02:07 +03:00
net xfrm: fix offloading of cross-family tunnels 2025-09-15 11:35:06 +02:00
rust
…
samples
…
scripts Kbuild updates for v6.17 2025-08-06 07:32:52 +03:00
security
…
sound
…
tools selftests: net/forwarding: test purge of active DWRR classes 2025-08-13 18:11:48 -07:00
usr
…
virt
…
.clang-format
…
.clippy.toml
…
.cocciconfig
…
.editorconfig
…
.get_maintainer.ignore
…
.gitattributes
…
.gitignore
…
.mailmap
…
.pylintrc
…
.rustfmt.toml
…
COPYING
…
CREDITS Kbuild updates for v6.17 2025-08-06 07:32:52 +03:00
Kbuild
…
Kconfig
…
MAINTAINERS MAINTAINERS: Remove bouncing T7XX reviewer 2025-08-11 20:04:36 -07:00
Makefile Kbuild updates for v6.17 2025-08-06 07:32:52 +03:00
README
…

README 

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the reStructuredText markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.