From: Ido Schimmel <idosch@nvidia.com>
To: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>
Cc: netdev@vger.kernel.org, "David S . Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@kernel.org>,
Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
Simon Horman <horms@kernel.org>, David Ahern <dsahern@kernel.org>,
William Tu <u9012063@gmail.com>,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH net-next 1/2] erspan: drop packets with an unknown ERSPAN version
Date: Tue, 20 Oct 2026 20:15:55 +0300 [thread overview]
Message-ID: <20261020171555.GA3236673@shredder> (raw)
In-Reply-To: <20261018090236.2487997-2-yanhaishuang@cmss.chinamobile.com>
On Sun, Oct 18, 2026 at 05:02:35PM +0800, Haishuang Yan wrote:
> The ERSPAN type II and III receive paths take the length of the ERSPAN
> header from the version field of the packet, with erspan_hdr_len(), but
> never check that the version is one they know: 1 for type II or 2 for
> type III.
>
> For any other version, erspan_hdr_len() returns 0 or the type III
> length. With version 0, the ERSPAN header is not pulled at all, so it
> is passed up as the start of the inner Ethernet frame, and in collect_md
> mode the metadata is copied from 8 bytes after the base header, which
> pskb_may_pull() did not cover.
__iptunnel_pull_header() drops the packet if it can't pull the Ethernet
header of the encapsulated packet, so there's no memory safety issue
here. Only reading metadata from the wrong place.
>
> Reject such packets, as a packet with a truncated ERSPAN header already
> is.
>
> Fixes: f551c91de262 ("net: erspan: introduce erspan v2 for ip_gre")
> Fixes: 94d7d8f29287 ("ip6_gre: add erspan v2 support")
Given that this never worked and that there's no security issue here,
drop these tags and target v2 at net-next when it re-opens.
>
> Signed-off-by: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>
next prev parent reply other threads:[~2026-10-20 17:16 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-18 9:02 [PATCH net-next 0/2] erspan: fix two header parsing issues on receive Haishuang Yan
2026-10-18 9:02 ` [PATCH net-next 1/2] erspan: drop packets with an unknown ERSPAN version Haishuang Yan
2026-10-20 17:15 ` Ido Schimmel [this message]
2026-10-18 9:02 ` [PATCH net-next 2/2] erspan: skip the platform specific sub-header of ERSPAN type III Haishuang Yan
2026-10-20 17:16 ` Ido Schimmel
2026-10-18 9:09 ` [PATCH net-next 0/2] erspan: fix two header parsing issues on receive netdev-bot+sinfo
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261020171555.GA3236673@shredder \
--to=idosch@nvidia.com \
--cc=davem@davemloft.net \
--cc=dsahern@kernel.org \
--cc=edumazet@kernel.org \
--cc=horms@kernel.org \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=u9012063@gmail.com \
--cc=yanhaishuang@cmss.chinamobile.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®