On Wed, Sep 25, 2013 at 09:55:50AM -0700, Pravin Shelar wrote:

On Tue, Sep 24, 2013 at 10:54 PM, Steffen Klassert
[off-list ref] wrote:

quoted

We might extend the used aera of a skb beyond the total
headroom when we install the ipip header. Fix this by
calling skb_cow_head() unconditionally.

It is better to call skb_cow_head() from ipip_tunnel_xmit() as it is
consistent with gre.

I think this would just move the bug from ipip to gre. ipgre_xmit()
uses dev->needed_headroom which is based on the guessed output device
in ip_tunnel_bind_dev(). If the device we get from the route lookup
in ip_tunnel_xmit() is different from the guessed one and the resulting
max_headroom is bigger than dev->needed_headroom, we run into that bug
because skb_cow_head() will not be called with the updated
dev->needed_headroom.