From: Steffen Klassert <steffen.klassert@secunet.com>
Date: Mon, 19 Mar 2018 06:15:39 +0000 (+0100)
Subject: xfrm: Fix transport mode skb control buffer usage.
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=58be6253b0030799f653e9c53fab649260d52221;p=GitHub%2Fmoto-9609%2Fandroid_kernel_motorola_exynos9610.git

xfrm: Fix transport mode skb control buffer usage.

[ Upstream commit 9a3fb9fb84cc30577c1b012a6a3efda944684291 ]

A recent commit introduced a new struct xfrm_trans_cb
that is used with the sk_buff control buffer. Unfortunately
it placed the structure in front of the control buffer and
overlooked that the IPv4/IPv6 control buffer is still needed
for some layer 4 protocols. As a result the IPv4/IPv6 control
buffer is overwritten with this structure. Fix this by setting
a apropriate header in front of the structure.

Fixes acf568ee859f ("xfrm: Reinject transport-mode packets ...")
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---

diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index 5b2409746ae0..9f492dc417d5 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -26,6 +26,12 @@ struct xfrm_trans_tasklet {
 };
 
 struct xfrm_trans_cb {
+	union {
+		struct inet_skb_parm	h4;
+#if IS_ENABLED(CONFIG_IPV6)
+		struct inet6_skb_parm	h6;
+#endif
+	} header;
 	int (*finish)(struct net *net, struct sock *sk, struct sk_buff *skb);
 };