The patch titled Make udp_encap_rcv use pskb_may_pull has been added to the -mm tree. Its filename is make-udp_encap_rcv-use-pskb_may_pull.patch See http://www.zip.com.au/~akpm/linux/patches/stuff/added-to-mm.txt to find out what to do about this ------------------------------------------------------ Subject: Make udp_encap_rcv use pskb_may_pull From: Olaf Kirch <okir@xxxxxxx> IPsec with NAT-T breaks on some notebooks using the latest e1000 chipset, when header split is enabled. When receiving sufficiently large packets, the driver puts everything up to and including the UDP header into the header portion of the skb, and the rest goes into the paged part. udp_encap_rcv forgets to use pskb_may_pull, and fails to decapsulate it. Instead, it passes it up it to the IKE daemon. Signed-off-by: Olaf Kirch <okir@xxxxxxx> Signed-off-by: Jean Delvare <jdelvare@xxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxx> --- net/ipv4/udp.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff -puN net/ipv4/udp.c~make-udp_encap_rcv-use-pskb_may_pull net/ipv4/udp.c --- a/net/ipv4/udp.c~make-udp_encap_rcv-use-pskb_may_pull +++ a/net/ipv4/udp.c @@ -921,24 +921,33 @@ static int udp_encap_rcv(struct sock * s return 1; #else struct udp_sock *up = udp_sk(sk); - struct udphdr *uh = skb->h.uh; + struct udphdr *uh; struct iphdr *iph; int iphlen, len; - __u8 *udpdata = (__u8 *)uh + sizeof(struct udphdr); - __be32 *udpdata32 = (__be32 *)udpdata; + __u8 *udpdata; + __be32 *udpdata32; __u16 encap_type = up->encap_type; /* if we're overly short, let UDP handle it */ - if (udpdata > skb->tail) + len = skb->len - sizeof(struct udphdr); + if (len <= 0) return 1; /* if this is not encapsulated socket, then just return now */ if (!encap_type) return 1; - len = skb->tail - udpdata; + /* If this is a paged skb, make sure we pull up + * whatever data we need to look at. */ + if (!pskb_may_pull(skb, sizeof(struct udphdr) + min(len, 8))) + return 1; + /* Now we can get the pointers */ + uh = skb->h.uh; + udpdata = (__u8 *)uh + sizeof(struct udphdr); + udpdata32 = (__be32 *)udpdata; + switch (encap_type) { default: case UDP_ENCAP_ESPINUDP: _ Patches currently in -mm which might be from okir@xxxxxxx are make-udp_encap_rcv-use-pskb_may_pull.patch - To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html