Patch "udp: disable inner UDP checksum offloads in IPsec case" has been added to the 4.9-stable tree

This is a note to let you know that I've just added the patch titled

udp: disable inner UDP checksum offloads in IPsec case

to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
udp-disable-inner-udp-checksum-offloads-in-ipsec-case.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Ansis Atteka <[email protected]>
Date: Fri, 21 Apr 2017 15:23:05 -0700
Subject: udp: disable inner UDP checksum offloads in IPsec case

From: Ansis Atteka <[email protected]>

[ Upstream commit b40c5f4fde22fb98eff205b3aece05b471c24eed ]

Otherwise, UDP checksum offloads could corrupt ESP packets by attempting to calculate UDP checksum when this inner UDP packet is already protected by IPsec.

One way to reproduce this bug is to have a VM with virtio_net driver (UFO set to ON in the guest VM); and then encapsulate all guest's Ethernet frames in Geneve; and then further encrypt Geneve with IPsec. In this case following symptoms are observed:
1. If using ixgbe NIC, then it will complain with following error message:
ixgbe 0000:01:00.1: partial checksum but l4 proto=32!
2. Receiving IPsec stack will drop all the corrupted ESP packets and increase XfrmInStateProtoError counter in /proc/net/xfrm_stat.
3. iperf UDP test from the VM with packet sizes above MTU will not work at all.
4. iperf TCP test from the VM will get ridiculously low performance because.

---
 net/ipv4/udp_offload.c |    3 +++
 1 file changed, 3 insertions(+)

@@ -29,6 +29,7 @@ static struct sk_buff *__skb_udp_tunnel_
 	u16 mac_len = skb->mac_len;
 	int udp_offset, outer_hlen;
 	__wsum partial;
+	bool need_ipsec;
 
 	if (unlikely(!pskb_may_pull(skb, tnl_hlen)))
 		goto out;

@@ -62,8 +63,10 @@ static struct sk_buff *__skb_udp_tunnel_
 
 	ufo = !!(skb_shinfo(skb)->gso_type & SKB_GSO_UDP);
 
+	need_ipsec = skb_dst(skb) && dst_xfrm(skb_dst(skb));
 	/* Try to offload checksum if possible */
 	offload_csum = !!(need_csum &&
+			  !need_ipsec &&
 			  (skb->dev->features &
 			   (is_ipv6 ? (NETIF_F_HW_CSUM | NETIF_F_IPV6_CSUM) :
 				      (NETIF_F_HW_CSUM | NETIF_F_IP_CSUM))));

Patches currently in stable-queue which might be from [email protected] are

queue-4.9/udp-disable-inner-udp-checksum-offloads-in-ipsec-case.patch