xfrm: Fix GSO for IPsec with GRE tunnel.

We reset the encapsulation field of the skb too early
in xfrm_output. As a result, the GRE GSO handler does
not segment the packets. This leads to a performance
drop down. We fix this by resetting the encapsulation
field right before we do the transformation, when
the inner headers become invalid.

Fixes: f1bd7d659ef0 ("xfrm: Add encapsulation header offsets while SKB is not encrypted")
Reported-by: Vicente De Luca <vdeluca@zendesk.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>

diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index 31a2e6d34dba652dd568d93ae077de3136c252ca..73ad8c8ef344ac4bb6229b49c0b14b099e5fdf13 100644 (file)
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -105,6 +105,9 @@ static int xfrm_output_one(struct sk_buff *skb, int err)
                if (xfrm_offload(skb)) {
                        x->type_offload->encap(x, skb);
                } else {
+                       /* Inner headers are invalid now. */
+                       skb->encapsulation = 0;
+
                        err = x->type->output(x, skb);
                        if (err == -EINPROGRESS)
                                goto out;
@@ -208,7 +211,6 @@ int xfrm_output(struct sock *sk, struct sk_buff *skb)
        int err;
 
        secpath_reset(skb);
-       skb->encapsulation = 0;
 
        if (xfrm_dev_offload_ok(skb, x)) {
                struct sec_path *sp;