ip_tunnel: Fix a memory corruption in ip_tunnel_xmit