ipv6: xfrm: dereference inner ipv6 header if encapsulated

strssndktn · klassert · commit 5d0ff542d026 · 2013-08-19T09:38:25.000+02:00
In xfrm6_local_error use inner_header if the packet was encapsulated.

Cc: Steffen Klassert &lt;steffen.klassert@secunet.com&gt;
Acked-by: Eric Dumazet &lt;edumazet@google.com&gt;
Signed-off-by: Hannes Frederic Sowa &lt;hannes@stressinduktion.org&gt;
Signed-off-by: Steffen Klassert &lt;steffen.klassert@secunet.com&gt;
diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
@@ -59,10 +59,12 @@ static void xfrm6_local_rxpmtu(struct sk_buff *skb, u32 mtu)
 void xfrm6_local_error(struct sk_buff *skb, u32 mtu)
 {
 	struct flowi6 fl6;
+	const struct ipv6hdr *hdr;
 	struct sock *sk = skb->sk;
 
+	hdr = skb->encapsulation ? inner_ipv6_hdr(skb) : ipv6_hdr(skb);
 	fl6.fl6_dport = inet_sk(sk)->inet_dport;
-	fl6.daddr = ipv6_hdr(skb)->daddr;
+	fl6.daddr = hdr->daddr;
 
 	ipv6_local_error(sk, EMSGSIZE, &fl6, mtu);
 }

Original file line number	Diff line number	Diff line change
`@@ -59,10 +59,12 @@ static void xfrm6_local_rxpmtu(struct sk_buff *skb, u32 mtu)`
`59`	`59`	`void xfrm6_local_error(struct sk_buff *skb, u32 mtu)`
`60`	`60`	`{`
`61`	`61`	`struct flowi6 fl6;`
	`62`	`+ const struct ipv6hdr *hdr;`
`62`	`63`	`struct sock *sk = skb->sk;`
`63`	`64`
	`65`	`+ hdr = skb->encapsulation ? inner_ipv6_hdr(skb) : ipv6_hdr(skb);`
`64`	`66`	`fl6.fl6_dport = inet_sk(sk)->inet_dport;`
`65`		`- fl6.daddr = ipv6_hdr(skb)->daddr;`
	`67`	`+ fl6.daddr = hdr->daddr;`
`66`	`68`
`67`	`69`	`ipv6_local_error(sk, EMSGSIZE, &fl6, mtu);`
`68`	`70`	`}`