ip6_tunnel: Clear IP6CB in ip6tunnel_xmit()
authorEli Cooper <elicooper@gmx.com>
Tue, 1 Nov 2016 15:45:12 +0000 (23:45 +0800)
committerDavid S. Miller <davem@davemloft.net>
Wed, 2 Nov 2016 19:18:36 +0000 (15:18 -0400)
commit23f4ffedb7d751c7e298732ba91ca75d224bc1a6
tree321347ff8bd924a8c5cbca50318e96e8e9375fa3
parent45788f1f5534fb02063ca077719592c2c3ba621e
ip6_tunnel: Clear IP6CB in ip6tunnel_xmit()

skb->cb may contain data from previous layers. In the observed scenario,
the garbage data were misinterpreted as IP6CB(skb)->frag_max_size, so
that small packets sent through the tunnel are mistakenly fragmented.

This patch unconditionally clears the control buffer in ip6tunnel_xmit(),
which affects ip6_tunnel, ip6_udp_tunnel and ip6_gre. Currently none of
these tunnels set IP6CB(skb)->flags, otherwise it needs to be done earlier.

Cc: stable@vger.kernel.org
Signed-off-by: Eli Cooper <elicooper@gmx.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
include/net/ip6_tunnel.h