From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D575635C68D; Tue, 21 Jul 2026 21:33:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784669591; cv=none; b=EcOkFp8SD8T3I3T2t24RpMmK2OAKQNQRyfzOmJtW7URowbRJoDDt6aR/QuQ6ZI+Jq1PUBo5PueSyb4MWIQr0Ksl3mxFwWTVfbsRrkjivqiNCsn8CXx3WBmgqGLpbWaHtBt+ToJLBYO8U6+P3KfPgQhsxzptyB8aQWsMjNHUfaBw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784669591; c=relaxed/simple; bh=psFaP1B19oDqMbCyPSkPJ+/Py4clhhWpQM10lPZNWMU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=hIFOcFcMEA4I/bxIoh8beX6P+xXHYdH5hFcLzSQZ5mos/ZwId+ISx1dDAXk5hScN1jTVhSS97iSQsd1ceLr8JWcXARrI2fIXAzEJt2bBCxooOPmiG06jDgUjMW1jLx384eBOz8hrmdOx7ZPsSsF0NB0Gmzar2hikQZL8i8o6Bi8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=iqO+wv5m; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="iqO+wv5m" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 46F791F000E9; Tue, 21 Jul 2026 21:33:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1784669589; bh=FCxrHdWGOl5DoNtSjCF0WWvls3eZnUJr0tXZq/btVRQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=iqO+wv5mvxNpmsn+en+gM06KeIxVPbLlZW9vnKpxG02bTC0P4ZDvEzlaQ+jEea1OI gJtvQsgoOpeo8wUUcslTO/aTEj+LAd93txMvgWhoeiWHgVisCt01Jfni8QmSt4s6tC Ai5wamUhELWI3rj05r+h3UpVM+zJH2XHiE8opxao= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Mike Yu , Steffen Klassert , Sasha Levin Subject: [PATCH 6.1 0569/1067] xfrm: Support crypto offload for inbound IPv6 ESP packets not in GRO path Date: Tue, 21 Jul 2026 17:19:30 +0200 Message-ID: <20260721152437.332439127@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260721152424.521567757@linuxfoundation.org> References: <20260721152424.521567757@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Mike Yu [ Upstream commit f7e8542d71e908706855a9f3e9e7844fea1feea0 ] IPsec crypt offload supports outbound IPv6 ESP packets, but it doesn't support inbound IPv6 ESP packets. This change enables the crypto offload for inbound IPv6 ESP packets that are not handled through GRO code path. If HW drivers add the offload information to the skb, the packet will be handled in the crypto offload rx code path. Apart from the change in crypto offload rx code path, the change in xfrm_policy_check is also needed. Exampe of RX data path: +-----------+ +-------+ | HW Driver |-->| wlan0 |--------+ +-----------+ +-------+ | v +---------------+ +------+ +------>| Network Stack |-->| Apps | | +---------------+ +------+ | | | v +--------+ +------------+ | ipsec1 |<--| XFRM Stack | +--------+ +------------+ Test: Enabled both in/out IPsec crypto offload, and verified IPv6 ESP packets on Android device on both wifi/cellular network Signed-off-by: Mike Yu Signed-off-by: Steffen Klassert Stable-dep-of: 68de007d5ac9 ("xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[]") Signed-off-by: Sasha Levin --- net/xfrm/xfrm_input.c | 2 +- net/xfrm/xfrm_policy.c | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c index 190cc865131491..c3c909d9c8fab4 100644 --- a/net/xfrm/xfrm_input.c +++ b/net/xfrm/xfrm_input.c @@ -470,7 +470,7 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) struct xfrm_offload *xo = xfrm_offload(skb); struct sec_path *sp; - if (encap_type < 0 || (xo && xo->flags & XFRM_GRO)) { + if (encap_type < 0 || (xo && (xo->flags & XFRM_GRO || encap_type == 0))) { x = xfrm_input_state(skb); if (unlikely(x->km.state != XFRM_STATE_VALID)) { diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c index aeb994f96192cd..aabcbdd62b1cdc 100644 --- a/net/xfrm/xfrm_policy.c +++ b/net/xfrm/xfrm_policy.c @@ -3604,12 +3604,15 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, } if (!pol) { + const bool is_crypto_offload = sp && + (xfrm_input_state(skb)->xso.type == XFRM_DEV_OFFLOAD_CRYPTO); + if (net->xfrm.policy_default[dir] == XFRM_USERPOLICY_BLOCK) { XFRM_INC_STATS(net, LINUX_MIB_XFRMINNOPOLS); return 0; } - if (sp && secpath_has_nontransport(sp, 0, &xerr_idx)) { + if (sp && secpath_has_nontransport(sp, 0, &xerr_idx) && !is_crypto_offload) { xfrm_secpath_reject(xerr_idx, skb, &fl); XFRM_INC_STATS(net, LINUX_MIB_XFRMINNOPOLS); return 0; -- 2.53.0