[PATCH ipsec] xfrm: Set transport header to fix UDP GRO handling

[PATCH ipsec] xfrm: Set transport header to fix UDP GRO handling

[Tobias Brunner]

The referenced commit replaced a call to __xfrm4|6_udp_encap_rcv() with
a custom check for non-ESP markers.  But what the called function also
did was setting the transport header to the ESP header.  The function
that follows, esp4|6_gro_receive(), relies on that being set when it calls
xfrm_parse_spi().  We have to set the full offset as the skb's head was
not moved yet so adding just the UDP header length won't work.

Fixes: e3fd05777685 ("xfrm: Fix UDP GRO handling for some corner cases")
Signed-off-by: Tobias Brunner <tobias@strongswan.org>
---
 net/ipv4/xfrm4_input.c | 3 +++
 net/ipv6/xfrm6_input.c | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/net/ipv4/xfrm4_input.c b/net/ipv4/xfrm4_input.c
index 0d31a8c108d4..f28cfd88eaf5 100644
--- a/net/ipv4/xfrm4_input.c
+++ b/net/ipv4/xfrm4_input.c
@@ -202,6 +202,9 @@ struct sk_buff *xfrm4_gro_udp_encap_rcv(struct sock *sk, struct list_head *head,
 	if (len <= sizeof(struct ip_esp_hdr) || udpdata32[0] == 0)
 		goto out;
 
+	/* set the transport header to ESP */
+	skb_set_transport_header(skb, offset);
+
 	NAPI_GRO_CB(skb)->proto = IPPROTO_UDP;
 
 	pp = call_gro_receive(ops->callbacks.gro_receive, head, skb);
diff --git a/net/ipv6/xfrm6_input.c b/net/ipv6/xfrm6_input.c
index 841c81abaaf4..9005fc156a20 100644
--- a/net/ipv6/xfrm6_input.c
+++ b/net/ipv6/xfrm6_input.c
@@ -202,6 +202,9 @@ struct sk_buff *xfrm6_gro_udp_encap_rcv(struct sock *sk, struct list_head *head,
 	if (len <= sizeof(struct ip_esp_hdr) || udpdata32[0] == 0)
 		goto out;
 
+	/* set the transport header to ESP */
+	skb_set_transport_header(skb, offset);
+
 	NAPI_GRO_CB(skb)->proto = IPPROTO_UDP;
 
 	pp = call_gro_receive(ops->callbacks.gro_receive, head, skb);
-- 
2.43.0

Re: [PATCH ipsec] xfrm: Set transport header to fix UDP GRO handling

[Steffen Klassert]

On Tue, Jun 24, 2025 at 02:47:20PM +0200, Tobias Brunner wrote:
> The referenced commit replaced a call to __xfrm4|6_udp_encap_rcv() with
> a custom check for non-ESP markers.  But what the called function also
> did was setting the transport header to the ESP header.  The function
> that follows, esp4|6_gro_receive(), relies on that being set when it calls
> xfrm_parse_spi().  We have to set the full offset as the skb's head was
> not moved yet so adding just the UDP header length won't work.
> 
> Fixes: e3fd05777685 ("xfrm: Fix UDP GRO handling for some corner cases")
> Signed-off-by: Tobias Brunner <tobias@strongswan.org>

Applied, thanks Tobias!