xfrm: Prevent locally generated packets from direct output in tunnel mode

[ Upstream commit 59630e2ccd728703cc826e3a3515d70f8c7a766c ]

Add a check to ensure locally generated packets (skb->sk != NULL) do
not use direct output in tunnel mode, as these packets require proper
L2 header setup that is handled by the normal XFRM processing path.

Fixes: 5eddd76ec2fd ("xfrm: fix tunnel mode TX datapath in packet offload mode")
Signed-off-by: Jianbo Liu <jianbol@nvidia.com>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index a30538a980cc7f6bb5580abe59f9f324877a9e7d..9277dd4ed541aba6a671df361a5b26c090da5966 100644 (file)
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -766,8 +766,12 @@ int xfrm_output(struct sock *sk, struct sk_buff *skb)
                /* Exclusive direct xmit for tunnel mode, as
                 * some filtering or matching rules may apply
                 * in transport mode.
+                * Locally generated packets also require
+                * the normal XFRM path for L2 header setup,
+                * as the hardware needs the L2 header to match
+                * for encryption, so skip direct output as well.
                 */
-               if (x->props.mode == XFRM_MODE_TUNNEL)
+               if (x->props.mode == XFRM_MODE_TUNNEL && !skb->sk)
                        return xfrm_dev_direct_output(sk, x, skb);
 
                return xfrm_output_resume(sk, skb, 0);