From: Lorenzo Bianconi <[email protected]>
Date: Thu, 4 Apr 2019 16:37:53 +0200
> ipip6 tunnels run iptunnel_pull_header on received skbs. This can
> determine the following use-after-free accessing iph pointer since
> the packet will be 'uncloned' running pskb_expand_head if it is a
> cloned gso skb (e.g if the packet has been sent though a veth device)
...
> Fix it resetting iph pointer after iptunnel_pull_header
>
> Fixes: a09a4c8dd1ec ("tunnels: Remove encapsulation offloads on decap")
> Tested-by: Jianlin Shi <[email protected]>
> Signed-off-by: Lorenzo Bianconi <[email protected]>
Good catch, applied, thanks.
