> From: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
> Date: Thu,  4 Apr 2019 16:37:53 +0200
> 
> > ipip6 tunnels run iptunnel_pull_header on received skbs. This can
> > determine the following use-after-free accessing iph pointer since
> > the packet will be 'uncloned' running pskb_expand_head if it is a
> > cloned gso skb (e.g if the packet has been sent though a veth device)
>  ...
> > Fix it resetting iph pointer after iptunnel_pull_header
> > 
> > Fixes: a09a4c8dd1ec ("tunnels: Remove encapsulation offloads on decap")
> > Tested-by: Jianlin Shi <jishi@redhat.com>
> > Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
> 
> Good catch, applied, thanks.

looking at the code it seems there is the same issue for erspan_v{4,6}.
I will post a fix soon.

Regards,
Lorenzo