]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
l2tp: reset skb control buffer on xmit
authorDavid Bauer <mail@david-bauer.net>
Tue, 18 Nov 2025 00:16:18 +0000 (01:16 +0100)
committerPaolo Abeni <pabeni@redhat.com>
Thu, 20 Nov 2025 10:52:24 +0000 (11:52 +0100)
commitd70b592551ff23747e26e74081205babf8dba9b6
treed9eebc92a350558ed94c3cd7fd0291ef84c8f42c
parent3ceb6ac2116ecda1c5d779bb73271479e70fccb4
l2tp: reset skb control buffer on xmit

The L2TP stack did not reset the skb control buffer before sending the
encapsulated package.

In a setup with an ath10k radio and batman-adv over an L2TP tunnel
massive fragmentations happen sporadically if the L2TP tunnel is
established over IPv4.

L2TP might reset some of the fields in the IP control buffer, but L2TP
assumes the type of the control buffer to be of an IPv4 packet.

In case the L2TP interface is used as a batadv hardif or the packet is
an IPv6 packet, this assumption breaks.

Clear the entire control buffer to avoid such mishaps altogether.

Fixes: f77ae9390438 ("[PPPOL2TP]: Reset meta-data in xmit function")
Signed-off-by: David Bauer <mail@david-bauer.net>
Link: https://patch.msgid.link/20251118001619.242107-1-mail@david-bauer.net
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
net/l2tp/l2tp_core.c