Skip to content

Commit

Permalink
esp4: Fix udpencap for local TCP packets.
Browse files Browse the repository at this point in the history
Locally generated TCP packets are usually cloned, so we
do skb_cow_data() on this packets. After that we need to
reload the pointer to the esp header. On udpencap this
header has an offset to skb_transport_header, so take this
offset into account.

Fixes: 67d349e ("net/esp4: Fix invalid esph pointer crash")
Fixes: fca11eb ("esp4: Reorganize esp_output")
Reported-by: Don Bowman <[email protected]>
Signed-off-by: Steffen Klassert <[email protected]>
  • Loading branch information
klassert committed May 4, 2017
1 parent f411af6 commit 0e78a87
Showing 1 changed file with 4 additions and 1 deletion.
5 changes: 4 additions & 1 deletion net/ipv4/esp4.c
Original file line number Diff line number Diff line change
Expand Up @@ -248,6 +248,7 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
u8 *tail;
u8 *vaddr;
int nfrags;
int esph_offset;
struct page *page;
struct sk_buff *trailer;
int tailen = esp->tailen;
Expand Down Expand Up @@ -313,11 +314,13 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
}

cow:
esph_offset = (unsigned char *)esp->esph - skb_transport_header(skb);

nfrags = skb_cow_data(skb, tailen, &trailer);
if (nfrags < 0)
goto out;
tail = skb_tail_pointer(trailer);
esp->esph = ip_esp_hdr(skb);
esp->esph = (struct ip_esp_hdr *)(skb_transport_header(skb) + esph_offset);

skip_cow:
esp_output_fill_trailer(tail, esp->tfclen, esp->plen, esp->proto);
Expand Down

0 comments on commit 0e78a87

Please sign in to comment.