From 7114f29fe210da06458ecae28d8e5a3a5e8a4e7f Mon Sep 17 00:00:00 2001 From: David Bauer Date: Mon, 17 Nov 2025 01:50:08 +0100 Subject: [PATCH] net/l2tp: reset skb control buffer The L2TP stack did not reset the skb control buffer before handing off the package to the lower netdev. In a setup with an ath10k radio and batman-adv over an L2TP tunnel massive fragmentations happen sporadically if the L2TP tunnel is established over IPv4. L2TP might reset some of the fields in the IP control buffer, but L2TP assumes the type of the control buffer to be of an IPv4 packet, while due to it being Layer 2, this is not a given. Clear the entire control buffer to avoid such mishaps altogether. Link: https://github.com/torvalds/linux/commit/d70b592551ff23747e26e74081205babf8dba9b6 Signed-off-by: David Bauer --- ...18-net-l2tp-reset-skb-control-buffer.patch | 40 +++++++++++++++++++ 1 file changed, 40 insertions(+) create mode 100644 target/linux/generic/backport-6.12/615-v6.18-net-l2tp-reset-skb-control-buffer.patch diff --git a/target/linux/generic/backport-6.12/615-v6.18-net-l2tp-reset-skb-control-buffer.patch b/target/linux/generic/backport-6.12/615-v6.18-net-l2tp-reset-skb-control-buffer.patch new file mode 100644 index 0000000000..b1a666fafb --- /dev/null +++ b/target/linux/generic/backport-6.12/615-v6.18-net-l2tp-reset-skb-control-buffer.patch @@ -0,0 +1,40 @@ +From 6317095a52e769169ca1bd9a2d9100c0feb5e92b Mon Sep 17 00:00:00 2001 +From: David Bauer +Date: Mon, 17 Nov 2025 01:46:47 +0100 +Subject: [PATCH] net/l2tp: reset skb control buffer + +The L2TP stack did not reset the skb control buffer before handing off +the package to the lower netdev. + +In a setup with an ath10k radio and batman-adv over an L2TP tunnel +massive fragmentations happen sporadically if the L2TP tunnel is +established over IPv4. + +L2TP might reset some of the fields in the IP control buffer, but L2TP +assumes the type of the control buffer to be of an IPv4 packet, while +due to it being Layer 2, this is not a given. + +Clear the entire control buffer to avoid such mishaps altogether. + +Link: https://github.com/torvalds/linux/commit/d70b592551ff23747e26e74081205babf8dba9b6 + +Signed-off-by: David Bauer +--- + net/l2tp/l2tp_core.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/net/l2tp/l2tp_core.c ++++ b/net/l2tp/l2tp_core.c +@@ -1249,9 +1249,9 @@ static int l2tp_xmit_core(struct l2tp_se + else + l2tp_build_l2tpv3_header(session, __skb_push(skb, session->hdr_len)); + +- /* Reset skb netfilter state */ +- memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt)); +- IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED | IPSKB_REROUTED); ++ /* Reset control buffer */ ++ memset(skb->cb, 0, sizeof(skb->cb)); ++ + nf_reset_ct(skb); + + /* L2TP uses its own lockdep subclass to avoid lockdep splats caused by