From: Jianbo Liu Date: Wed, 29 Oct 2025 09:50:25 +0000 (+0200) Subject: xfrm: Prevent locally generated packets from direct output in tunnel mode X-Git-Tag: v6.18-rc7~25^2~11^2~1 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=59630e2ccd728703cc826e3a3515d70f8c7a766c;p=thirdparty%2Flinux.git xfrm: Prevent locally generated packets from direct output in tunnel mode Add a check to ensure locally generated packets (skb->sk != NULL) do not use direct output in tunnel mode, as these packets require proper L2 header setup that is handled by the normal XFRM processing path. Fixes: 5eddd76ec2fd ("xfrm: fix tunnel mode TX datapath in packet offload mode") Signed-off-by: Jianbo Liu Reviewed-by: Leon Romanovsky Signed-off-by: Steffen Klassert --- diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c index a98b5bf55ac31..54222fcbd7fd8 100644 --- a/net/xfrm/xfrm_output.c +++ b/net/xfrm/xfrm_output.c @@ -772,8 +772,12 @@ int xfrm_output(struct sock *sk, struct sk_buff *skb) /* Exclusive direct xmit for tunnel mode, as * some filtering or matching rules may apply * in transport mode. + * Locally generated packets also require + * the normal XFRM path for L2 header setup, + * as the hardware needs the L2 header to match + * for encryption, so skip direct output as well. */ - if (x->props.mode == XFRM_MODE_TUNNEL) + if (x->props.mode == XFRM_MODE_TUNNEL && !skb->sk) return xfrm_dev_direct_output(sk, x, skb); return xfrm_output_resume(sk, skb, 0);