xfrm: Fix GSO for IPsec with GRE tunnel.

We reset the encapsulation field of the skb too early
in xfrm_output. As a result, the GRE GSO handler does
not segment the packets. This leads to a performance
drop down. We fix this by resetting the encapsulation
field right before we do the transformation, when
the inner headers become invalid.

Fixes: f1bd7d659ef0 ("xfrm: Add encapsulation header offsets while SKB is not encrypted")
Reported-by: Vicente De Luca <vdeluca@zendesk.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>

1 files changed, 3 insertions, 1 deletions

diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index 31a2e6d34dba..73ad8c8ef344 100644
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -105,6 +105,9 @@ static int xfrm_output_one(struct sk_buff *skb, int err)
                 if (xfrm_offload(skb)) {
                         x->type_offload->encap(x, skb);
                 } else {
+                        /* Inner headers are invalid now. */
+                        skb->encapsulation = 0;
+
                         err = x->type->output(x, skb);
                         if (err == -EINPROGRESS)
                                 goto out;
@@ -208,7 +211,6 @@ int xfrm_output(struct sock *sk, struct sk_buff *skb)
         int err;
 
         secpath_reset(skb);
-        skb->encapsulation = 0;
 
         if (xfrm_dev_offload_ok(skb, x)) {
                 struct sec_path *sp;