Re: [PATCH ipsec v2 4/7] xfrm: prevent AES-GCM nonce reuse after early GSO

[sashiko-bot@kernel.org]

> With software ESP offload, xfrm_output() attaches a secpath before
> calling xfrm_output_gso() for an encapsulated GSO packet, but
> skb_gso_segment() leaves the splitted skbs sharing the same secpath,
> including xo->seq.
> 
> For the i-th splitted segment, xfrm_output_gso() reaches
> xfrm_replay_overflow() through xfrm_output_one(), which allocates
> sequence number N+i to that segment, and then incorrectly overwrites
> the shared xo->seq with N+i. If encryption is delayed until all t
> segments have been processed, xo->seq ends up with value N+t-1 for all
> segments. When validate_xmit_xfrm() calls esp*_xmit() for each
> segment, the IV is constructed from the same value N+t-1, causing
> nonce reuse in AES-GCM. Yet, each ESP header correctly keeps using
> value N+i from its private XFRM_SKB_CB.
> 
> Call secpath_set() for each offloaded segment before xfrm_output2(),
> so sequence allocation writes to private metadata that cannot be
> overwritten by later segments.
> 
> Fixes: a204aef9fd77 ("xfrm: call xfrm_output_gso when inner_protocol is set in xfrm_output")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261108142652.1330952-1-Jeremy.Jean@oss.cyber.gouv.fr?part=4