Re: [PATCH net] ipip: fix skb leak in collect_md mode when metadata_dst allocation fails

[Fernando Fernandez Mancera <fmancera@suse.de>]

On 8/19/26 12:43 PM, Anton Danilov wrote:
> In collect_md mode ipip_tunnel_rcv() returns 0 without freeing the skb
> when ip_tun_rx_dst() fails to allocate the metadata_dst. ipip_rcv() and
> mplsip_rcv() are registered as xfrm_tunnel handlers, so tunnel4_rcv()
> and tunnelmpls4_rcv() read the zero return as "the packet has been
> consumed" and do not free it either. The skb is leaked.
> 
> The other tunnel drivers all dispose of the packet at this point:
> ip6_tunnel.c jumps to its drop label, ip_gre.c and ip6_gre.c return
> PACKET_REJECT, which makes gre_rcv() free the skb. Only ipip returns 0.
> 
> Jump to the existing drop label instead. It frees the skb and still
> returns 0, so the packet keeps being reported as consumed, which is what
> we want here: the outer header has already been pulled, and neither the
> remaining handlers nor an ICMP unreachable have any use for it.
> 
> Triggering this needs an ipip or mplsip tunnel in collect_md mode and an
> atomic allocation failure, which is why it has gone unnoticed.
> 
> Fixes: cfc7381b3002 ("ip_tunnel: add collect_md mode to IPIP tunnel")
> Cc: stable@vger.kernel.org
> Assisted-by: Claude-Code:claude-opus-5
> Signed-off-by: Anton Danilov <littlesmilingcloud@gmail.com>
> ---
>   net/ipv4/ipip.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
> index b643194f57d2..ddf62b45566b 100644
> --- a/net/ipv4/ipip.c
> +++ b/net/ipv4/ipip.c
> @@ -248,7 +248,7 @@ static int ipip_tunnel_rcv(struct sk_buff *skb, u8 ipproto)
>   
>   			tun_dst = ip_tun_rx_dst(skb, flags, 0, 0);
>   			if (!tun_dst)
> -				return 0;
> +				goto drop;
>   			ip_tunnel_md_udp_encap(skb, &tun_dst->u.tun_info);
>   		}
>   		skb_reset_mac_header(skb);

Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>

Thanks!