1 files changed, 10 insertions, 3 deletions

diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index a85ae2f7a21c..303012adf9e6 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -750,6 +750,7 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
         int    gre_hlen;
         __be32 dst;
         int    mtu;
+        u8     ttl;
 
         if (skb->ip_summed == CHECKSUM_PARTIAL &&
             skb_checksum_help(skb))
@@ -760,7 +761,10 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
 
         if (dev->header_ops && dev->type == ARPHRD_IPGRE) {
                 gre_hlen = 0;
-                tiph = (const struct iphdr *)skb->data;
+                if (skb->protocol == htons(ETH_P_IP))
+                        tiph = (const struct iphdr *)skb->data;
+                else
+                        tiph = &tunnel->parms.iph;
         } else {
                 gre_hlen = tunnel->hlen;
                 tiph = &tunnel->parms.iph;
@@ -812,6 +816,7 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
                         goto tx_error;
         }
 
+        ttl = tiph->ttl;
         tos = tiph->tos;
         if (tos == 1) {
                 tos = 0;
@@ -904,11 +909,12 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
                 dev_kfree_skb(skb);
                 skb = new_skb;
                 old_iph = ip_hdr(skb);
+                /* Warning : tiph value might point to freed memory */
         }
 
-        skb_reset_transport_header(skb);
         skb_push(skb, gre_hlen);
         skb_reset_network_header(skb);
+        skb_set_transport_header(skb, sizeof(*iph));
         memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
         IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED |
                               IPSKB_REROUTED);
@@ -927,8 +933,9 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
         iph->tos                =       ipgre_ecn_encapsulate(tos, old_iph, skb);
         iph->daddr              =       fl4.daddr;
         iph->saddr              =       fl4.saddr;
+        iph->ttl                =       ttl;
 
-        if ((iph->ttl = tiph->ttl) == 0) {
+        if (ttl == 0) {
                 if (skb->protocol == htons(ETH_P_IP))
                         iph->ttl = old_iph->ttl;
 #if IS_ENABLED(CONFIG_IPV6)