Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 87cdf314 authored by Yossi Kuperman's avatar Yossi Kuperman Committed by Steffen Klassert
Browse files

xfrm: Verify MAC header exists before overwriting eth_hdr(skb)->h_proto 



Artem Savkov reported that commit 5efec5c6 leads to a packet loss under
IPSec configuration. It appears that his setup consists of a TUN device,
which does not have a MAC header.

Make sure MAC header exists.

Note: TUN device sets a MAC header pointer, although it does not have one.

Fixes: 5efec5c6 ("xfrm: Fix eth_hdr(skb)->h_proto to reflect inner IP version")
Reported-by: default avatarArtem Savkov <artem.savkov@gmail.com>
Tested-by: default avatarArtem Savkov <artem.savkov@gmail.com>
Signed-off-by: default avatarYossi Kuperman <yossiku@mellanox.com>
Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
parent b8b549ee

net/ipv4/xfrm4_mode_tunnel.c

+2 −1
Original line number Diff line number Diff line
@@ -92,6 +92,7 @@ static int xfrm4_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb) 


	skb_reset_network_header(skb);

	skb_mac_header_rebuild(skb);

	if (skb->mac_len)

		eth_hdr(skb)->h_proto = skb->protocol;



	err = 0;

net/ipv6/xfrm6_mode_tunnel.c

+2 −1
Original line number Diff line number Diff line
@@ -92,6 +92,7 @@ static int xfrm6_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb) 


	skb_reset_network_header(skb);

	skb_mac_header_rebuild(skb);

	if (skb->mac_len)

		eth_hdr(skb)->h_proto = skb->protocol;



	err = 0;