ipv4/ip_gre: set transport header correctly to gre header (861aa6d5) · Commits · 戴 / test

ipgre_tunnel_xmit() incorrectly sets transport header to inner payload instead of GRE header. It seems copy-and-pasted from ipip.c. So set transport header to gre header. (In ipip case the transport header is the inner ip header, so that's correct.) Found by inspection. In practice the incorrect transport header doesn't matter because the skb usually is sent to another net_device or socket, so the transport header isn't referenced. Signed-off-by:

Isaku Yamahata <yamahata@valinux.co.jp> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/ipv4/ip_gre.c

+1 −1

Original line number	Original line	Diff line number	Diff line
	@@ -912,9 +912,9 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff skb, struct net_device dev
	/* Warning : tiph value might point to freed memory */		/* Warning : tiph value might point to freed memory */
	}		}

	skb_reset_transport_header(skb);
	skb_push(skb, gre_hlen);		skb_push(skb, gre_hlen);
	skb_reset_network_header(skb);		skb_reset_network_header(skb);
			skb_set_transport_header(skb, sizeof(*iph));
	memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));		memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
	IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE \| IPSKB_XFRM_TRANSFORMED \|		IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE \| IPSKB_XFRM_TRANSFORMED \|
	IPSKB_REROUTED);		IPSKB_REROUTED);

Admin message