esp4: Fix udpencap for local TCP packets. (0e78a873) · Commits · 戴 / test

Locally generated TCP packets are usually cloned, so we do skb_cow_data() on this packets. After that we need to reload the pointer to the esp header. On udpencap this header has an offset to skb_transport_header, so take this offset into account. Fixes: ("net/esp4: Fix invalid esph pointer crash") Fixes: ("esp4: Reorganize esp_output") Reported-by:

Don Bowman <db@donbowman.ca> Signed-off-by:

Steffen Klassert <steffen.klassert@secunet.com>

net/ipv4/esp4.c

+4 −1

Original line number	Diff line number	Diff line
		@@ -248,6 +248,7 @@ int esp_output_head(struct xfrm_state x, struct sk_buff skb, struct esp_info *
		u8 *tail;
		u8 *vaddr;
		int nfrags;
		int esph_offset;
		struct page *page;
		struct sk_buff *trailer;
		int tailen = esp->tailen;
		@@ -313,11 +314,13 @@ int esp_output_head(struct xfrm_state x, struct sk_buff skb, struct esp_info *
		}

		cow:
		esph_offset = (unsigned char *)esp->esph - skb_transport_header(skb);

		nfrags = skb_cow_data(skb, tailen, &trailer);
		if (nfrags < 0)
		goto out;
		tail = skb_tail_pointer(trailer);
		esp->esph = ip_esp_hdr(skb);
		esp->esph = (struct ip_esp_hdr *)(skb_transport_header(skb) + esph_offset);

		skip_cow:
		esp_output_fill_trailer(tail, esp->tfclen, esp->plen, esp->proto);

Admin message