esp: Fix GRO when the headers not fully in the linear part of the skb.
authorSteffen Klassert <steffen.klassert@secunet.com>
Fri, 5 Jan 2018 07:35:47 +0000 (08:35 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 25 Feb 2018 10:07:46 +0000 (11:07 +0100)
commit201941360944afbde6ab6f5ff70f96f16d334971
tree7c8faa42a800d0cef17e76f86e8919ec248ac478
parent447f1170c23bea791c3b5efdc0264519fd22f565
esp: Fix GRO when the headers not fully in the linear part of the skb.

commit 374d1b5a81f7f9cc5e7f095ac3d5aff3f6600376 upstream.

The GRO layer does not necessarily pull the complete headers
into the linear part of the skb, a part may remain on the
first page fragment. This can lead to a crash if we try to
pull the headers, so make sure we have them on the linear
part before pulling.

Fixes: 7785bba299a8 ("esp: Add a software GRO codepath")
Reported-by: syzbot+82bbd65569c49c6c0c4d@syzkaller.appspotmail.com
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/ipv4/esp4_offload.c
net/ipv6/esp6_offload.c