From: Eric Dumazet <[email protected]>
Date: Wed, 24 Apr 2019 08:04:05 -0700
> Before calling __ip_options_compile(), we need to ensure the network
> header is a an IPv4 one, and that it is already pulled in skb->head.
>
> RAW sockets going through a tunnel can end up calling ipv4_link_failure()
> with total garbage in the skb, or arbitrary lengthes.
>
> syzbot report :
...
> Fixes: ed0de45a1008 ("ipv4: recompile ip options in ipv4_link_failure")
> Signed-off-by: Eric Dumazet <[email protected]>
Applied and queued up for -stable.
Thanks for fixing this.
