tree b2d73dc2b12900d8de34e1790397a604b9e44c93
parent 3cf5cdecd99c9c186a5ea518d93bbf3045b6e3aa
author Wyatt Feng <wf.kernel.dev@gmail.com> 1788018272 +0800
committer Steffen Klassert <steffen.klassert@secunet.com> 1788258251 +0200

net: xfrm: reject unrepresentable espintcp transport headers

ESP-in-TCP can hand xfrm packets whose transport header offset no longer
fits after the stream parser trims the TCP envelope. The plain transport
header reset truncates that offset and triggers the skb warning path.

Use the careful transport-header helper and drop the skb through the
existing XFRM error path when the offset cannot be represented.

Fixes: e27cca96cd68 ("xfrm: add espintcp (RFC 8229)")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Assisted-by: Codex:GPT-5.4
Signed-off-by: Wyatt Feng <wf.kernel.dev@gmail.com>
Signed-off-by: Ren Wei <weir@nebusec.ai>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>