]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
espintcp: restore IP CB before handing the packet to xfrm
authorSabrina Dubroca <sd@queasysnail.net>
Thu, 13 Aug 2020 14:24:04 +0000 (16:24 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 14 Oct 2020 09:55:49 +0000 (11:55 +0200)
commit80683929112b453970b9d6234fcf1c26aa079c53
treeb39e1e70984492cbb0549797f63c3d651eec240f
parent1427c13cc16fd402fb42753c5e39d64a9c085dd4
espintcp: restore IP CB before handing the packet to xfrm

commit 4eb2e13415757a2bce5bb0d580d22bbeef1f5346 upstream.

Xiumei reported a bug with espintcp over IPv6 in transport mode,
because xfrm6_transport_finish expects to find IP6CB data (struct
inet6_skb_cb). Currently, espintcp zeroes the CB, but the relevant
part is actually preserved by previous layers (first set up by tcp,
then strparser only zeroes a small part of tcp_skb_tb), so we can just
relocate it to the start of skb->cb.

Fixes: e27cca96cd68 ("xfrm: add espintcp (RFC 8229)")
Reported-by: Xiumei Mu <xmu@redhat.com>
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/xfrm/espintcp.c