From c82b48b63a939e9b0f40bd00f95bcea4502fcada Mon Sep 17 00:00:00 2001 From: Leon Romanovsky Date: Tue, 13 May 2025 13:59:19 +0300 Subject: [PATCH] xfrm: prevent configuration of interface index when offload is used Both packet and crypto offloads perform decryption while packet is arriving to the HW from the wire. It means that there is no possible way to perform lookup on XFRM if_id as it can't be set to be "before' HW. So instead of silently ignore this configuration, let's warn users about misconfiguration. Signed-off-by: Leon Romanovsky Signed-off-by: Steffen Klassert --- net/xfrm/xfrm_device.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/xfrm/xfrm_device.c b/net/xfrm/xfrm_device.c index 3be0139373f7..81fd486b5e56 100644 --- a/net/xfrm/xfrm_device.c +++ b/net/xfrm/xfrm_device.c @@ -251,6 +251,11 @@ int xfrm_dev_state_add(struct net *net, struct xfrm_state *x, return -EINVAL; } + if (xuo->flags & XFRM_OFFLOAD_INBOUND && x->if_id) { + NL_SET_ERR_MSG(extack, "XFRM if_id is not supported in RX path"); + return -EINVAL; + } + is_packet_offload = xuo->flags & XFRM_OFFLOAD_PACKET; /* We don't yet support TFC padding. */ -- 2.50.1