From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f65.google.com (mail-wr1-f65.google.com [209.85.221.65]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 03CD241C31C for ; Tue, 16 Jun 2026 10:03:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.65 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781604220; cv=none; b=HeCdkbVd78O8CS4sJPNyLbg5DOqddl6IV7Tpyty6JxZv5kKh6+tOqM9lil7fAgmMsWt5lgiQKxV7KcUqkZGPEDb5+ucseaVInaJOmEVzG5W0A16rn0ZQRSIsZiwdcbEIUqI5Ma4rKcOk7YZ8/+VJOa6wD4DR3EaKdRjzGdYEuns= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781604220; c=relaxed/simple; bh=cHY9Abcv4JeQfjc0VTlYZepQDXj06t3VGMBSC/q49yI=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=UBdkxgkwgDIrvvh9+ZKtsTkyZUdWuQPAd0+bx4oMPqpSuKcJMrqUEEMblvYR6lBxQfjQxkxII2dP2rIlS47ETkCUKfLJfxqyJa6f/1OGR0HS+vUM4kdPgoJiIhGLVMXkdLWAC3b/aXZkzJP0EI2koGY0yLXlog7jPDUqCQMAbOw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=ovn.org; spf=pass smtp.mailfrom=gmail.com; arc=none smtp.client-ip=209.85.221.65 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=ovn.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Received: by mail-wr1-f65.google.com with SMTP id ffacd0b85a97d-45ef6565cfdso2033898f8f.0 for ; Tue, 16 Jun 2026 03:03:38 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781604217; x=1782209017; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=G3J3dF/rleitNHrIVaZmT+xGJuXa5FDx3AO/xzdX7Ng=; b=CbgLxPFEqiL1Cgy1pfj3dZwHPG/+a6OYMeeIBVduNlVkB3k09WzD2H63I0V/guhQQ+ faOZaH+sNq7ljfyfnMFUqO93R1JieK+RNyAHk+rWzko9GhGnJEZ0Ayp8vsxkM/JWe2h+ xZ/NOg7dPh0St/5M+5hYNq26vh7yGe2nKX4BsazJfNJ04gDh6rQL/xkooXm10RsfiMlZ D/qt2389JWIPKlBeIRGl5bf+OxXvc9Z9Y+kHLcXuL8dmImHUUSQlGtsplnWIQ+ifroyJ wLdUbei4yJqapxyhaTSBZc5tIQuSh96tJK6Qb+xnEFTazhSt4fLVcQS/b4584V+K+ulS 08fg== X-Forwarded-Encrypted: i=1; AFNElJ/2hz2Z5n0WjI8zXEVHCc/h6K4iUgtnOAGL1PToWQD3CqB4bqGPSlko5UFuF267l9yPw5GyGwDiKybVQ8g=@vger.kernel.org X-Gm-Message-State: AOJu0Yz+BIaxokkjJFP36t0+pV0f6f/HkO2bg97LA/irPsjp0EeOsoB7 rq2UwxIG2rhFmDInJn/O0g8N6334A7M/CCQ32gb+Lp1YlpM42Yhdd4wK X-Gm-Gg: Acq92OGKHEZ67st+L+iZE9YFKqnFKdBFif88b3c+EtUuYtejXEWUsx5+AvbkR+As2n7 kH4YOjbD89Uzf87tLEoysCrga17+LKlbHUqn081+QLoE5mpESRz0/gbUYMCFPIY1ZX7n3S+6FaI wJ5gWMvw9jAotvDw1eB1JJYDxe6qObd6DEtcbGGK+Jc29PFeN7NqtqwlJwNPKfocQiAmkkko2km /TqA3iibo40m+OcWf76S6eRfNCJ8l86qTAWJdHe2OA5Nd3NvnYpF35SgAn3t8CryVbaOjgKAKbw NArfi6V6Fe+mIFnrY8ZY1yhQK6w7sO4DmcXAJC3ouznE6m8YQKnqvCrhHzEWQt8+ms2PaCKauke S56mz/2EwLgADdsrwB8BtWwC+tIGLhcy4ANXmjgqeEN3iZqBPTN358ewctfT9FxOmj2z5LY/PWA 5/o62CJizFDMarDux0peGBctm1VS+aDRPZfNdhQMSv8HkYECYzGgYse/OL4+Z2jWNlQdhw4g== X-Received: by 2002:a5d:5906:0:b0:460:3233:beed with SMTP id ffacd0b85a97d-4619f31b6ddmr3918817f8f.41.1781604216985; Tue, 16 Jun 2026 03:03:36 -0700 (PDT) Received: from im-t490s.redhat.com (89-24-35-102.nat.epc.tmcz.cz. [89.24.35.102]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-4606f2b0d4fsm46870652f8f.24.2026.06.16.03.03.35 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 16 Jun 2026 03:03:36 -0700 (PDT) From: Ilya Maximets To: netdev@vger.kernel.org Cc: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Kees Cook , "Gustavo A. R. Silva" , Nathan Chancellor , Nick Desaulniers , Bill Wendling , Justin Stitt , linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org, llvm@lists.linux.dev, Ilya Maximets , Johan Thomsen Subject: [PATCH net] net: dst_metadata: fix false-positive memcpy overflow in tun_dst_unclone Date: Tue, 16 Jun 2026 12:03:29 +0200 Message-ID: <20260616100332.1308294-1-i.maximets@ovn.org> X-Mailer: git-send-email 2.54.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit kmalloc_flex() in metadata_dst_alloc() sets __counted_by for the structure to the options_len, which is then initialized to zero. Later, we're initializing the structure by copying the tunnel info together with the options, and this triggers a warning for a potential memcpy overflow, since the compiler estimates that the options can't fit into the structure, even though the memory for them is actually allocated. memcpy: detected buffer overflow: 104 byte write of buffer size 96 WARNING: CPU: X PID: Y at lib/string_helpers.c:1036 __fortify_report skb_tunnel_info_unclone+0x179/0x190 geneve_xmit+0x7fe/0xe00 The issue is triggered when built with clang and source fortification. Fix that by doing the copy in two stages: first - the main data with the options_len, then the options. This way the correct length should be known at the time of the copy. It would be better if the options_len never changed after allocation, but the allocation code is a little separate from the initialization and it would be awkward and potentially dangerous to return a struct with options_len set to a non-zero value from the metadata_dst_alloc(). Another option would be to use ip_tunnel_info_opts_set(), but it is doing too many unnecessary operations for the use case here. Fixes: 69050f8d6d07 ("treewide: Replace kmalloc with kmalloc_obj for non-scalar types") Reported-by: Johan Thomsen Closes: https://lore.kernel.org/netdev/CAKv6aAM8_EWgXScnKmKYm_4SwGDVBK++dzfP+Y6msUXbp99QUw@mail.gmail.com/ Signed-off-by: Ilya Maximets --- Johan, if you can test this one in your setup as well, that would be great. Thanks. include/net/dst_metadata.h | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/include/net/dst_metadata.h b/include/net/dst_metadata.h index 1fc2fb03ce3f..f45d1e3163f0 100644 --- a/include/net/dst_metadata.h +++ b/include/net/dst_metadata.h @@ -164,8 +164,11 @@ static inline struct metadata_dst *tun_dst_unclone(struct sk_buff *skb) if (!new_md) return ERR_PTR(-ENOMEM); - memcpy(&new_md->u.tun_info, &md_dst->u.tun_info, - sizeof(struct ip_tunnel_info) + md_size); + /* Copy in two stages to keep the __counted_by happy. */ + new_md->u.tun_info = md_dst->u.tun_info; + memcpy(ip_tunnel_info_opts(&new_md->u.tun_info), + ip_tunnel_info_opts(&md_dst->u.tun_info), md_size); + #ifdef CONFIG_DST_CACHE /* Unclone the dst cache if there is one */ if (new_md->u.tun_info.dst_cache.cache) { -- 2.54.0