Commit 94e3ca2f authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge tag 'ipsec-2024-03-19' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec 

Steffen Klassert says:

====================
pull request (net): ipsec 2024-03-19

1) Fix possible page_pool leak triggered by esp_output.
   From Dragos Tatulea.

2) Fix UDP encapsulation in software GSO path.
   From Leon Romanovsky.

* tag 'ipsec-2024-03-19' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec:
  xfrm: Allow UDP encapsulation only in offload modes
  net: esp: fix bad handling of pages from page_pool
====================

Link: https://lore.kernel.org/r/20240319110151.409825-1-steffen.klassert@secunet.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 78a2f5e6 773bb766

include/linux/skbuff.h

+10 −0
Original line number Diff line number Diff line
@@ -3523,6 +3523,16 @@ int skb_cow_data_for_xdp(struct page_pool *pool, struct sk_buff **pskb, 
			 struct bpf_prog *prog);

bool napi_pp_put_page(struct page *page, bool napi_safe);



static inline void

skb_page_unref(const struct sk_buff *skb, struct page *page, bool napi_safe)

{

#ifdef CONFIG_PAGE_POOL

	if (skb->pp_recycle && napi_pp_put_page(page, napi_safe))

		return;

#endif

	put_page(page);

}



static inline void

napi_frag_unref(skb_frag_t *frag, bool recycle, bool napi_safe)

{

net/ipv4/esp4.c

+4 −4
Original line number Diff line number Diff line
@@ -95,7 +95,7 @@ static inline struct scatterlist *esp_req_sg(struct crypto_aead *aead, 
			     __alignof__(struct scatterlist));

}



static void esp_ssg_unref(struct xfrm_state *x, void *tmp)

static void esp_ssg_unref(struct xfrm_state *x, void *tmp, struct sk_buff *skb)

{

	struct crypto_aead *aead = x->data;

	int extralen = 0;
@@ -114,7 +114,7 @@ static void esp_ssg_unref(struct xfrm_state *x, void *tmp) 
	 */

	if (req->src != req->dst)

		for (sg = sg_next(req->src); sg; sg = sg_next(sg))

			put_page(sg_page(sg));

			skb_page_unref(skb, sg_page(sg), false);

}



#ifdef CONFIG_INET_ESPINTCP
@@ -260,7 +260,7 @@ static void esp_output_done(void *data, int err) 
	}



	tmp = ESP_SKB_CB(skb)->tmp;

	esp_ssg_unref(x, tmp);

	esp_ssg_unref(x, tmp, skb);

	kfree(tmp);



	if (xo && (xo->flags & XFRM_DEV_RESUME)) {
@@ -639,7 +639,7 @@ int esp_output_tail(struct xfrm_state *x, struct sk_buff *skb, struct esp_info * 
	}



	if (sg != dsg)

		esp_ssg_unref(x, tmp);

		esp_ssg_unref(x, tmp, skb);



	if (!err && x->encap && x->encap->encap_type == TCP_ENCAP_ESPINTCP)

		err = esp_output_tail_tcp(x, skb);

net/ipv6/esp6.c

+4 −4
Original line number Diff line number Diff line
@@ -112,7 +112,7 @@ static inline struct scatterlist *esp_req_sg(struct crypto_aead *aead, 
			     __alignof__(struct scatterlist));

}



static void esp_ssg_unref(struct xfrm_state *x, void *tmp)

static void esp_ssg_unref(struct xfrm_state *x, void *tmp, struct sk_buff *skb)

{

	struct crypto_aead *aead = x->data;

	int extralen = 0;
@@ -131,7 +131,7 @@ static void esp_ssg_unref(struct xfrm_state *x, void *tmp) 
	 */

	if (req->src != req->dst)

		for (sg = sg_next(req->src); sg; sg = sg_next(sg))

			put_page(sg_page(sg));

			skb_page_unref(skb, sg_page(sg), false);

}



#ifdef CONFIG_INET6_ESPINTCP
@@ -294,7 +294,7 @@ static void esp_output_done(void *data, int err) 
	}



	tmp = ESP_SKB_CB(skb)->tmp;

	esp_ssg_unref(x, tmp);

	esp_ssg_unref(x, tmp, skb);

	kfree(tmp);



	esp_output_encap_csum(skb);
@@ -677,7 +677,7 @@ int esp6_output_tail(struct xfrm_state *x, struct sk_buff *skb, struct esp_info 
	}



	if (sg != dsg)

		esp_ssg_unref(x, tmp);

		esp_ssg_unref(x, tmp, skb);



	if (!err && x->encap && x->encap->encap_type == TCP_ENCAP_ESPINTCP)

		err = esp_output_tail_tcp(x, skb);

net/xfrm/xfrm_device.c

+2 −1
Original line number Diff line number Diff line
@@ -407,7 +407,8 @@ bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x) 
	struct xfrm_dst *xdst = (struct xfrm_dst *)dst;

	struct net_device *dev = x->xso.dev;



	if (!x->type_offload)

	if (!x->type_offload ||

	    (x->xso.type == XFRM_DEV_OFFLOAD_UNSPECIFIED && x->encap))

		return false;



	if (x->xso.type == XFRM_DEV_OFFLOAD_PACKET ||