esp4: Fix udpencap for local TCP packets.
Locally generated TCP packets are usually cloned, so we do skb_cow_data() on this packets. After that we need to reload the pointer to the esp header. On udpencap this header has an offset to skb_transport_header, so take this offset into account. Fixes:67d349ed60
("net/esp4: Fix invalid esph pointer crash") Fixes:fca11ebde3
("esp4: Reorganize esp_output") Reported-by: Don Bowman <db@donbowman.ca> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
This commit is contained in:
parent
f411af6822
commit
0e78a87306
|
@ -248,6 +248,7 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
|
|||
u8 *tail;
|
||||
u8 *vaddr;
|
||||
int nfrags;
|
||||
int esph_offset;
|
||||
struct page *page;
|
||||
struct sk_buff *trailer;
|
||||
int tailen = esp->tailen;
|
||||
|
@ -313,11 +314,13 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
|
|||
}
|
||||
|
||||
cow:
|
||||
esph_offset = (unsigned char *)esp->esph - skb_transport_header(skb);
|
||||
|
||||
nfrags = skb_cow_data(skb, tailen, &trailer);
|
||||
if (nfrags < 0)
|
||||
goto out;
|
||||
tail = skb_tail_pointer(trailer);
|
||||
esp->esph = ip_esp_hdr(skb);
|
||||
esp->esph = (struct ip_esp_hdr *)(skb_transport_header(skb) + esph_offset);
|
||||
|
||||
skip_cow:
|
||||
esp_output_fill_trailer(tail, esp->tfclen, esp->plen, esp->proto);
|
||||
|
|
Loading…
Reference in New Issue