Switch nf_flow_ip6_tunnel_proto() from skb_header_pointer() to pskb_may_pull() for header validation, aligning it with the approach used in nf_flow_ip4_tunnel_proto(). Move ctx->offset update inside the IPPROTO_IPV6 conditional block since it should only be adjusted when a tunnel is actually detected. While at it, use nexthdr instead of the hardcoded IPPROTO_IPV6 constant when setting ctx->tun.proto. Fixes: d98103575dcdd ("netfilter: flowtable: Add IP6IP6 rx sw acceleration") Signed-off-by: Lorenzo Bianconi --- net/netfilter/nf_flow_table_ip.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c index 9c05a50d6013..2946399ab715 100644 --- a/net/netfilter/nf_flow_table_ip.c +++ b/net/netfilter/nf_flow_table_ip.c @@ -347,15 +347,15 @@ static bool nf_flow_ip6_tunnel_proto(struct nf_flowtable_ctx *ctx, struct sk_buff *skb) { #if IS_ENABLED(CONFIG_IPV6) - struct ipv6hdr *ip6h, _ip6h; + struct ipv6hdr *ip6h; __be16 frag_off; u8 nexthdr; int hdrlen; - ip6h = skb_header_pointer(skb, ctx->offset, sizeof(*ip6h), &_ip6h); - if (!ip6h) + if (!pskb_may_pull(skb, sizeof(*ip6h) + ctx->offset)) return false; + ip6h = (struct ipv6hdr *)(skb_network_header(skb) + ctx->offset); if (ip6h->hop_limit <= 1) return false; @@ -367,9 +367,9 @@ static bool nf_flow_ip6_tunnel_proto(struct nf_flowtable_ctx *ctx, if (nexthdr == IPPROTO_IPV6) { ctx->tun.hdr_size = hdrlen; - ctx->tun.proto = IPPROTO_IPV6; + ctx->tun.proto = nexthdr; + ctx->offset += ctx->tun.hdr_size; } - ctx->offset += ctx->tun.hdr_size; return true; #else --- base-commit: 9772589b57e44aedc240211c5c3f7a684a034d3a change-id: 20260608-b4-nf_flow_ip6_tunnel_proto-update-8b64903825b4 Best regards, -- Lorenzo Bianconi