From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:57966 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752512AbcKRKgp (ORCPT ); Fri, 18 Nov 2016 05:36:45 -0500 Subject: Patch "ip6_tunnel: Clear IP6CB in ip6tunnel_xmit()" has been added to the 4.8-stable tree To: elicooper@gmx.com, davem@davemloft.net, gregkh@linuxfoundation.org Cc: , From: Date: Fri, 18 Nov 2016 11:36:44 +0100 Message-ID: <14794654041094@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled ip6_tunnel: Clear IP6CB in ip6tunnel_xmit() to the 4.8-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: ip6_tunnel-clear-ip6cb-in-ip6tunnel_xmit.patch and it can be found in the queue-4.8 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From foo@baz Fri Nov 18 11:35:46 CET 2016 From: Eli Cooper Date: Tue, 1 Nov 2016 23:45:12 +0800 Subject: ip6_tunnel: Clear IP6CB in ip6tunnel_xmit() From: Eli Cooper [ Upstream commit 23f4ffedb7d751c7e298732ba91ca75d224bc1a6 ] skb->cb may contain data from previous layers. In the observed scenario, the garbage data were misinterpreted as IP6CB(skb)->frag_max_size, so that small packets sent through the tunnel are mistakenly fragmented. This patch unconditionally clears the control buffer in ip6tunnel_xmit(), which affects ip6_tunnel, ip6_udp_tunnel and ip6_gre. Currently none of these tunnels set IP6CB(skb)->flags, otherwise it needs to be done earlier. Cc: stable@vger.kernel.org Signed-off-by: Eli Cooper Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- include/net/ip6_tunnel.h | 1 + 1 file changed, 1 insertion(+) --- a/include/net/ip6_tunnel.h +++ b/include/net/ip6_tunnel.h @@ -145,6 +145,7 @@ static inline void ip6tunnel_xmit(struct { int pkt_len, err; + memset(skb->cb, 0, sizeof(struct inet6_skb_parm)); pkt_len = skb->len - skb_inner_network_offset(skb); err = ip6_local_out(dev_net(skb_dst(skb)->dev), sk, skb); if (unlikely(net_xmit_eval(err))) Patches currently in stable-queue which might be from elicooper@gmx.com are queue-4.8/ip6_tunnel-clear-ip6cb-in-ip6tunnel_xmit.patch