]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
gtp: parse extension headers before reading inner protocol
authorZhixing Chen <running910@gmail.com>
Wed, 8 Jul 2026 04:22:44 +0000 (12:22 +0800)
committerPaolo Abeni <pabeni@redhat.com>
Tue, 21 Jul 2026 09:23:30 +0000 (11:23 +0200)
commit96e37e2f618e931aa97af95e707dcdfb1ec41264
treef744ea907ca82115562a629e60ae2a76b1758eea
parent5521ae71e32a8069ed4ca6e792179dc57bc43ab2
gtp: parse extension headers before reading inner protocol

GTPv1-U packets may carry a chain of extension headers before the inner
IP packet. The receive path already parses and skips these extension
headers, but it currently reads the inner protocol before doing so.

As a result, the first extension header byte is interpreted as the inner
IP version. Packets with extension headers are then dropped before PDP
lookup.

Parse the extension header chain before calling gtp_inner_proto(), so the
inner protocol is read from the actual inner IP header.

Fixes: c75fc0b9e5be ("gtp: identify tunnel via GTP device + GTP version + TEID + family")
Signed-off-by: Zhixing Chen <running910@gmail.com>
Link: https://patch.msgid.link/20260708042244.120898-1-running910@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
drivers/net/gtp.c