[BUG] net: bridge: tunnel ID zero works on ingress but not egress

[BUG] net: bridge: tunnel ID zero works on ingress but not egress

[Cheng Yongkang]

Hi all,

__vlan_tunnel_info_add() accepts tunnel ID 0, creates a valid
tunnel_dst, and inserts the VLAN into the tunnel hash with key 0.
Ingress looks up key 0 and retags the frame.

The egress path treats tunnel_id == 0 as "not configured" and returns
before installing tunnel metadata.  The same mapping therefore works in
one direction and is inert in the other, while RTM_GETLINK reports it
as present.

Observed on Linux v7.3, commit
08ab31164c55f20c7a2653de3186ae333470e2c1:

  VID 100 -> tunnel id 0:
    ingress VNI 0 is retagged to VID 100
    egress emits VID 100 tagged but installs no VXLAN metadata

  remap VID 100 -> tunnel id 3000:
    egress immediately produces VNI 3000

Two independent cold boots produced the same result.

Either reject tunnel ID 0 as reserved or stop using zero as the egress
presence sentinel and make ingress and egress interpret the mapping
consistently.

This is distinct from candidate BR-063's netlink-size undercount for a
tid-zero entry, which has a pending sizing patch.

I found no matching functional fix or CVE.

The self-contained PoC and both console logs are available on request.

This was found with a multi-agent workflow; the
ingress/egress asymmetry was reproduced in QEMU.

Thanks,
Cheng Yongkang