[PATCH] net: ip_tunnel: initialize `options_len` before referencing options

[PATCH] net: ip_tunnel: initialize `options_len` before referencing options

[Gris Ge]

The following command triggers a kernel panic:

  ip link add d0 type dummy; ip link set d0 up
  ip route add 10.30.0.0/16 \
    encap ip id 300 geneve_opts 4660:66:11223344 dev d0

  memcpy: detected buffer overflow: 4 byte write of buffer size 0
  kernel BUG at lib/string_helpers.c:1044!
  ...
  ip_tun_parse_opts.part.0.cold+0x10/0x10
  ip_tun_build_state+0x116/0x2a0

On kernels built with GCC 15+ and `CONFIG_FORTIFY_SOURCE`, the fortified
`memcpy()` got 0 sized destination with request of 4 bytes length:

  static int ip_tun_parse_opts_geneve(...)
  {
      ...
      attr = tb[LWTUNNEL_IP_OPT_GENEVE_DATA];
      data_len = nla_len(attr); /* == 4 */

      struct geneve_opt *opt = ip_tunnel_info_opts(info) + opts_len;
      memcpy(opt->opt_data, nla_data(attr), data_len);
      /*     ^^^^^^^^^^^^^ 0 since options_len is assigned afterwards */

Fixed by initializing the counter before the options are referenced
matching what `ip_tunnel_info_opts_set()` already does

Fixes: bb5e62f2d547 ("net: Add options as a flexible array to struct ip_tunnel_info")
Cc: stable@vger.kernel.org
Signed-off-by: Gris Ge <cnfourt@gmail.com>
---
 net/ipv4/ip_tunnel_core.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c
index 5168d546ea2f..8fb4742aca92 100644
--- a/net/ipv4/ip_tunnel_core.c
+++ b/net/ipv4/ip_tunnel_core.c
@@ -711,6 +711,7 @@ static int ip_tun_build_state(struct net *net, struct nlattr *attr,
 	new_state->type = LWTUNNEL_ENCAP_IP;
 
 	tun_info = lwt_tun_info(new_state);
+	tun_info->options_len = opt_len;
 
 	err = ip_tun_set_opts(tb[LWTUNNEL_IP_OPTS], tun_info, extack);
 	if (err < 0) {
@@ -753,7 +754,6 @@ static int ip_tun_build_state(struct net *net, struct nlattr *attr,
 	}
 
 	tun_info->mode = IP_TUNNEL_INFO_TX;
-	tun_info->options_len = opt_len;
 
 	*ts = new_state;
 
@@ -1005,6 +1005,7 @@ static int ip6_tun_build_state(struct net *net, struct nlattr *attr,
 	new_state->type = LWTUNNEL_ENCAP_IP6;
 
 	tun_info = lwt_tun_info(new_state);
+	tun_info->options_len = opt_len;
 
 	err = ip_tun_set_opts(tb[LWTUNNEL_IP6_OPTS], tun_info, extack);
 	if (err < 0) {
@@ -1040,7 +1041,6 @@ static int ip6_tun_build_state(struct net *net, struct nlattr *attr,
 	}
 
 	tun_info->mode = IP_TUNNEL_INFO_TX | IP_TUNNEL_INFO_IPV6;
-	tun_info->options_len = opt_len;
 
 	*ts = new_state;
 
-- 
2.55.0

Re: [PATCH] net: ip_tunnel: initialize `options_len` before referencing options

[Eric Dumazet]

On Fri, Sep 11, 2026 at 10:53 PM Gris Ge <cnfourt@gmail.com> wrote:
>
> The following command triggers a kernel panic:
>
>   ip link add d0 type dummy; ip link set d0 up
>   ip route add 10.30.0.0/16 \
>     encap ip id 300 geneve_opts 4660:66:11223344 dev d0
>
>   memcpy: detected buffer overflow: 4 byte write of buffer size 0
>   kernel BUG at lib/string_helpers.c:1044!
>   ...
>   ip_tun_parse_opts.part.0.cold+0x10/0x10
>   ip_tun_build_state+0x116/0x2a0
>
> On kernels built with GCC 15+ and `CONFIG_FORTIFY_SOURCE`, the fortified
> `memcpy()` got 0 sized destination with request of 4 bytes length:
>
>   static int ip_tun_parse_opts_geneve(...)
>   {
>       ...
>       attr = tb[LWTUNNEL_IP_OPT_GENEVE_DATA];
>       data_len = nla_len(attr); /* == 4 */
>
>       struct geneve_opt *opt = ip_tunnel_info_opts(info) + opts_len;
>       memcpy(opt->opt_data, nla_data(attr), data_len);
>       /*     ^^^^^^^^^^^^^ 0 since options_len is assigned afterwards */
>
> Fixed by initializing the counter before the options are referenced
> matching what `ip_tunnel_info_opts_set()` already does
>
> Fixes: bb5e62f2d547 ("net: Add options as a flexible array to struct ip_tunnel_info")
> Cc: stable@vger.kernel.org
> Signed-off-by: Gris Ge <cnfourt@gmail.com>
> ---
>  net/ipv4/ip_tunnel_core.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c
> index 5168d546ea2f..8fb4742aca92 100644
> --- a/net/ipv4/ip_tunnel_core.c
> +++ b/net/ipv4/ip_tunnel_core.c
> @@ -711,6 +711,7 @@ static int ip_tun_build_state(struct net *net, struct nlattr *attr,
>         new_state->type = LWTUNNEL_ENCAP_IP;
>
>         tun_info = lwt_tun_info(new_state);
> +       tun_info->options_len = opt_len;
>
>         err = ip_tun_set_opts(tb[LWTUNNEL_IP_OPTS], tun_info, extack);
>         if (err < 0) {
> @@ -753,7 +754,6 @@ static int ip_tun_build_state(struct net *net, struct nlattr *attr,
>         }
>
>         tun_info->mode = IP_TUNNEL_INFO_TX;
> -       tun_info->options_len = opt_len;
>
>         *ts = new_state;
>
> @@ -1005,6 +1005,7 @@ static int ip6_tun_build_state(struct net *net, struct nlattr *attr,
>         new_state->type = LWTUNNEL_ENCAP_IP6;
>
>         tun_info = lwt_tun_info(new_state);
> +       tun_info->options_len = opt_len;
>
>         err = ip_tun_set_opts(tb[LWTUNNEL_IP6_OPTS], tun_info, extack);
>         if (err < 0) {
> @@ -1040,7 +1041,6 @@ static int ip6_tun_build_state(struct net *net, struct nlattr *attr,
>         }
>
>         tun_info->mode = IP_TUNNEL_INFO_TX | IP_TUNNEL_INFO_IPV6;
> -       tun_info->options_len = opt_len;
>
>         *ts = new_state;
>
> --
> 2.55.0

You forgot a 'net' in [PATCH net] . Please read
Documentation/process/maintainer-netdev.rst

Looks good, but please add a comment on the assignment stating
it must precede the option parsing, otherwise a future cleanup might move
it back down?

Or maybe use something similar than tunnel_key_opts_set() in
net/sched/act_tunnel_key.c
for consistency.