• B
    tunnel: Clear IPCB(skb)->opt before dst_link_failure called · 5146d1f1
    Bernie Harris 提交于
    IPCB may contain data from previous layers (in the observed case the
    qdisc layer). In the observed scenario, the data was misinterpreted as
    ip header options, which later caused the ihl to be set to an invalid
    value (<5). This resulted in an infinite loop in the mips implementation
    of ip_fast_csum.
    
    This patch clears IPCB(skb)->opt before dst_link_failure can be called for
    various types of tunnels. This change only applies to encapsulated ipv4
    packets.
    
    The code introduced in 11c21a30 which clears all of IPCB has been removed
    to be consistent with these changes, and instead the opt field is cleared
    unconditionally in ip_tunnel_xmit. The change in ip_tunnel_xmit applies to
    SIT, GRE, and IPIP tunnels.
    
    The relevant vti, l2tp, and pptp functions already contain similar code for
    clearing the IPCB.
    Signed-off-by: NBernie Harris <bernie.harris@alliedtelesis.co.nz>
    Signed-off-by: NDavid S. Miller <davem@davemloft.net>
    5146d1f1
ip6_tunnel.c 47.5 KB