esp4: Fix udpencap for local TCP packets.

Locally generated TCP packets are usually cloned, so we
do skb_cow_data() on this packets. After that we need to
reload the pointer to the esp header. On udpencap this
header has an offset to skb_transport_header, so take this
offset into account.

Fixes: 67d349ed603 ("net/esp4: Fix invalid esph pointer crash")
Fixes: fca11ebde3f0 ("esp4: Reorganize esp_output")
Reported-by: Don Bowman <db@donbowman.ca>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>

1 files changed, 4 insertions, 1 deletions

diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 65cc02bd82bc..93322f895eab 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -248,6 +248,7 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
         u8 *tail;
         u8 *vaddr;
         int nfrags;
+        int esph_offset;
         struct page *page;
         struct sk_buff *trailer;
         int tailen = esp->tailen;
@@ -313,11 +314,13 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
         }
 
 cow:
+        esph_offset = (unsigned char *)esp->esph - skb_transport_header(skb);
+
         nfrags = skb_cow_data(skb, tailen, &trailer);
         if (nfrags < 0)
                 goto out;
         tail = skb_tail_pointer(trailer);
-        esp->esph = ip_esp_hdr(skb);
+        esp->esph = (struct ip_esp_hdr *)(skb_transport_header(skb) + esph_offset);
 
 skip_cow:
         esp_output_fill_trailer(tail, esp->tfclen, esp->plen, esp->proto);