• Nicolas Dichtel's avatar
    vti6: fix input path · 63c43787
    Nicolas Dichtel authored
    Since commit 1625f452, vti6 is broken, all input packets are dropped
    (LINUX_MIB_XFRMINNOSTATES is incremented).
    
    XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6 is set by vti6_rcv() before calling
    xfrm6_rcv()/xfrm6_rcv_spi(), thus we cannot set to NULL that value in
    xfrm6_rcv_spi().
    
    A new function xfrm6_rcv_tnl() that enables to pass a value to
    xfrm6_rcv_spi() is added, so that xfrm6_rcv() is not touched (this function
    is used in several handlers).
    
    CC: Alexey Kodanev <alexey.kodanev@oracle.com>
    Fixes: 1625f452 ("net/xfrm_input: fix possible NULL deref of tunnel.ip6->parms.i_key")
    Signed-off-by: default avatarNicolas Dichtel <nicolas.dichtel@6wind.com>
    Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
    63c43787
ip6_vti.c 28 KB