>>
>> +static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
>> + int gre_hdr_len)
>> +{
>> + struct net *net = dev_net(skb->dev);
>> + struct ip_tunnel_net *itn;
>> + struct ip_tunnel *tunnel;
>> + struct metadata_dst *tun_dst = NULL;
>> + const struct iphdr *iph;
>> + struct erspanhdr *ershdr;
>> + __be32 index;
>> + __be32 session_id;
>> +
>> + itn = net_generic(net, erspan_net_id);
>> + iph = ip_hdr(skb);
>> + ershdr = (struct erspanhdr *)(skb->data + gre_hdr_len);
>
> You're not guaranteed the this ershdr area is pulled linearly in the
> SKB. Only the GRE header and it's options have that guarantee.
>
> So you'll need to add appropriate pskb_may_pull() checks here then
> reaload all of the packet pointers (including 'iph') afterwards.
Thanks, I will make the change and resubmit.
Regards,
William
