From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-lf1-f50.google.com (mail-lf1-f50.google.com [209.85.167.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9B36E3D1702 for ; Wed, 19 Aug 2026 10:44:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.50 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787136286; cv=none; b=G5t1GsB48NbTP8QAoJtMSnNh9BOw2A+9fW5XPLKh3QWZM9Rzn4oYpwNlzffngRD1B9QQlRm+G5Emv/UkmCirmX8vlUluzkCuTZMo4e0DZf34FtdOAsTy5bbec5bvPNBgUtWKx37WwLmy8N97CDfEvHpotEQDMbmJ9L/0K9Oqm8s= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787136286; c=relaxed/simple; bh=JMmW7X9llhVLh4tgVzKcuRGQaGeUo8lmg2UIbEtqdUA=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=QrOhXIk7GdH1w/dP/2IBbakDFn1DvSQnGsuTTjzW+Xua4utxQTDOprr+CyDBzFxyyy0rpwLKzL1vdUCqDxufSVuD55TGgy4jA5fgawfPP1+DZ6yM2p4ym8QXlzIzKHydnfQCuOF4ZKIdzCgLUX3nNoXCHobqIkn2zTp2F/YaWwQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=c797+PHR; arc=none smtp.client-ip=209.85.167.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="c797+PHR" Received: by mail-lf1-f50.google.com with SMTP id 2adb3069b0e04-5b29599b81cso1160481e87.1 for ; Wed, 19 Aug 2026 03:44:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787136283; x=1787741083; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=px3AKvC/vdgfBn94qjvmBeOftPFpPm1SynC6dbLUxb0=; b=c797+PHRwZ+xZZlXZXY6DEOAJIBwvk54c0GqPHL2YRI3zY6uy4p/lRR/Mf1T0tZhcD F4fipczlGmW6/OiYUfG+C6iodleXItIK90Vfv61q4ZGRI9fd3Um7c6PKhOws0FgdKdZo sXqgNnJCkVUgdCFPP5cdRDuQBl8Iy5acWLHkH7wEl1hhHyY1MZ3O50vESaroNcXdBW88 YZsd6QypqRwbTxNusC/4bR96kWraQlliENClYr6Q97GP9rq96PmZAHSFUviTbVsBVA+6 mI6x6AteRcsRcb7kzB2iVkr5HttitSBWz9b204A8iWp1BrNYCQuZD+d9McW9ZhjkkT62 YzXQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787136283; x=1787741083; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=px3AKvC/vdgfBn94qjvmBeOftPFpPm1SynC6dbLUxb0=; b=RnNIH6HjPJ6Yk1wXtlyWMBCU3lvRYCHqMeKQVZpdz1wsnjW3PywYvAJpgiiF5vysTr x2HOLph2tiMLiHJ/c1V0uBtUPx+Joh76rTm4mO42CNNLqfyzkFuIjffjw+uCiA5SwZp5 s2Htsb09vZvaO870/UOumJ/taFNduKnVQPDEOxQcLZ8YauW+w4seYilZtn/2CtafoAAH 2XhOfadFYrc70vpU78XHM6Ch/IDwd1LE5wt3SbUfl0IVvlyGmQXsc9oOV5HWphtDV6cU qh91f8/06WXFV22y+BnTyPPeKF+L446i29/uo2RkDxFnOvtswilnxwLM+NOYPq6lBkDH 5USA== X-Forwarded-Encrypted: i=1; AHgh+RoJORVbFC1AEFxIet+8p3yCe3A3725eybDPNMsaMy4wXSXN+unZRnZPxh5dnq22SVw4HzyTLoXFykpJraM=@vger.kernel.org X-Gm-Message-State: AOJu0YwBaPMqzIXEohluDam/AcQ1pLYT5H4t7obfCNlvy0VBH7O1k11b EYDgWzvCoOpqgCnBHwfe+LBpNCKVNzCSrUyIMCLDRNyip/HH8qascGPD X-Gm-Gg: AR+sD12XjOVtE6F4RsKTs3QP/6u16WkmgoOnSfS5nY6JB/isq0OQmUPfwK8dFqXZgqg gHnmTMzXt1VSlx9N2oKvC1nSqCKrPGZ4n/eNuKylQ5ikyFTAtvM3jkZ13ntmpauZ6xNe/PlrYqf HOSQdj7bNsdT3i1rnzMQoRw8lRXyg3zJXShlBGn1C63dzJjGuqIW605MDfDHjMeP7/gABSm8uYh Rbxyq6KErj28lB8AfrG3zt2djwcV9beZ+G9n4j9OyVqVtKM4C1z6ycFSzNfE+M7XCszZK9wXToq 7BEwX7GW1bgN52TF3LyMTOINLLuslx8OPds4js/VClJ+Er5KC6Yd0NOXTe/S+S9TxnxXwkTGNBT NKUAFWlpjWRY26i2tVwcwc638l7/adf5GmlgI+ICv74gchs56CxV+sTew+481cCOWrS6J2uFpqD Vz9jWi4t0oUTf9ptRi2Y7xYvT3HgC1dX4QHdnYuJ3kDntbBCLK6y+CACrf5Ap2wk3KaZkzNcNRJ NStMz58CZcD7s1NgJq/5+Pp6Xkzy25X X-Received: by 2002:ac2:4f03:0:b0:5ae:b01a:d213 with SMTP id 2adb3069b0e04-5b47892e750mr1257864e87.3.1787136282553; Wed, 19 Aug 2026 03:44:42 -0700 (PDT) Received: from dau-home-pc.. ([95.139.142.55]) by smtp.gmail.com with ESMTPSA id 2adb3069b0e04-5b4788539e3sm440890e87.13.2026.08.19.03.44.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Aug 2026 03:44:41 -0700 (PDT) From: Anton Danilov To: netdev@vger.kernel.org Cc: "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , David Ahern , Ido Schimmel , Alexei Starovoitov , Thomas Graf , Daniel Borkmann , linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH net] ipip: fix skb leak in collect_md mode when metadata_dst allocation fails Date: Wed, 19 Aug 2026 13:43:39 +0300 Message-ID: <20260819104338.432631-2-littlesmilingcloud@gmail.com> X-Mailer: git-send-email 2.47.3 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit In collect_md mode ipip_tunnel_rcv() returns 0 without freeing the skb when ip_tun_rx_dst() fails to allocate the metadata_dst. ipip_rcv() and mplsip_rcv() are registered as xfrm_tunnel handlers, so tunnel4_rcv() and tunnelmpls4_rcv() read the zero return as "the packet has been consumed" and do not free it either. The skb is leaked. The other tunnel drivers all dispose of the packet at this point: ip6_tunnel.c jumps to its drop label, ip_gre.c and ip6_gre.c return PACKET_REJECT, which makes gre_rcv() free the skb. Only ipip returns 0. Jump to the existing drop label instead. It frees the skb and still returns 0, so the packet keeps being reported as consumed, which is what we want here: the outer header has already been pulled, and neither the remaining handlers nor an ICMP unreachable have any use for it. Triggering this needs an ipip or mplsip tunnel in collect_md mode and an atomic allocation failure, which is why it has gone unnoticed. Fixes: cfc7381b3002 ("ip_tunnel: add collect_md mode to IPIP tunnel") Cc: stable@vger.kernel.org Assisted-by: Claude-Code:claude-opus-5 Signed-off-by: Anton Danilov --- net/ipv4/ipip.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c index b643194f57d2..ddf62b45566b 100644 --- a/net/ipv4/ipip.c +++ b/net/ipv4/ipip.c @@ -248,7 +248,7 @@ static int ipip_tunnel_rcv(struct sk_buff *skb, u8 ipproto) tun_dst = ip_tun_rx_dst(skb, flags, 0, 0); if (!tun_dst) - return 0; + goto drop; ip_tunnel_md_udp_encap(skb, &tun_dst->u.tun_info); } skb_reset_mac_header(skb); -- 2.47.3