[IPV4/IPV6]: Do not modify skb->h.raw until skb is unshared.

diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 5cd43a7bb571371fa68b23a49346a1d3399f9621..2ee1097dedf4be12e193b0aea5e04fb9659463b1 100644 (file)
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -803,8 +803,6 @@ static int ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
                        tunnel->err_count = 0;
        }
 
-       skb->h.raw = skb->nh.raw;
-
        max_headroom = LL_RESERVED_SPACE(tdev) + gre_hlen;
 
        if (skb_headroom(skb) < max_headroom || skb_cloned(skb) || skb_shared(skb)) {
@@ -823,6 +821,7 @@ static int ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
                old_iph = skb->nh.iph;
        }
 
+       skb->h.raw = skb->nh.raw;
        skb->nh.raw = skb_push(skb, gre_hlen);
        memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
        dst_release(skb->dst);

diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index 92d75a2e1461848a2f208aeb09ab41acf6ce5ff8..6f69aa521ffdffe28458e535e36f6f090e9bd1c1 100644 (file)
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -601,8 +601,6 @@ static int ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
                        tunnel->err_count = 0;
        }
 
-       skb->h.raw = skb->nh.raw;
-
        /*
         * Okay, now see if we can stuff it in the buffer as-is.
         */
@@ -624,6 +622,7 @@ static int ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
                old_iph = skb->nh.iph;
        }
 
+       skb->h.raw = skb->nh.raw;
        skb->nh.raw = skb_push(skb, sizeof(struct iphdr));
        memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
        dst_release(skb->dst);

diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 8576eda7d5f45025ee138c54e2d3e0530ede71f1..9d003767bb9f53938e312485ce286d2f627c8b26 100644 (file)
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -530,8 +530,6 @@ static int ipip6_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
                        tunnel->err_count = 0;
        }
 
-       skb->h.raw = skb->nh.raw;
-
        /*
         * Okay, now see if we can stuff it in the buffer as-is.
         */
@@ -553,6 +551,7 @@ static int ipip6_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
                iph6 = skb->nh.ipv6h;
        }
 
+       skb->h.raw = skb->nh.raw;
        skb->nh.raw = skb_push(skb, sizeof(struct iphdr));
        memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
        dst_release(skb->dst);