From: David Miller <davem@davemloft.net>
Date: Fri, 10 Oct 2014 14:15:59 -0400 (EDT)
Your original code works because you do things like "byte[12] & 0xf0" to
extract these fields.
Changing that th->doff sequence to instead be:
const u8 *bp;
u8 buf[13];
bp = __skb_header_pointer(skb, poff, sizeof(buf),
data, hlen, &buf);
if (!bp)
return poff;
poff += max_t(u32, sizeof(struct tcphdr), (bp[12] & 0xf0) >> 2);
break;
on top of your v3 patch works for me.
Please double-check my calculations.