Re: [PATCH net v3 1/1] ip6_tunnel: snapshot encap in xmit

[Ido Schimmel <idosch@nvidia.com>]

On Tue, Aug 25, 2026 at 03:29:49PM +0800, Ren Wei wrote:
> From: Zixuan Chai <petalzu987@gmail.com>
> 
> ip6_tnl_changelink() can update encapsulation parameters while the
> netdevice is transmitting packets. ip6_tnl_xmit() can calculate packet
> headroom with t->encap_hlen and later build an encapsulation header from
> the live t->encap. A concurrent update can change the encapsulation
> header between these accesses and make skb_push() underflow the skb head.
> 
> Take a local snapshot of t->encap before calculating the encapsulation
> header length. Use that same snapshot for headroom accounting, metadata
> validation, and build_header(). This keeps all encapsulation decisions
> for an skb consistent even if changelink updates the live configuration.
> 
> Fixes: b3a27b519b22 ("ip6_tunnel: Add support for fou/gue encapsulation")
> Cc: stable@vger.kernel.org
> Reported-by: Vega <vega@nebusec.ai>
> Assisted-by: Codex:gpt-5.4
> Signed-off-by: Zixuan Chai <petalzu987@gmail.com>
> Signed-off-by: Ren Wei <enjou1224z@gmail.com>

The comment from Sashiko [1] (which I asked to review multiple times
[2][3]) looks valid. We need something like the diff below. The helper
can then be used in the IPv4 code.

diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h
index 7c9aadfe8fe3..97f3e9e3ccf5 100644
--- a/include/net/ip_tunnels.h
+++ b/include/net/ip_tunnels.h
@@ -522,6 +522,15 @@ skb_vlan_inet_prepare(struct sk_buff *skb, bool inner_proto_inherit)
 	return SKB_NOT_DROPPED_YET;
 }
 
+static inline void ip_tunnel_encap_snapshot(struct ip_tunnel_encap *dst,
+					    const struct ip_tunnel_encap *src)
+{
+	dst->type = READ_ONCE(src->type);
+	dst->flags = READ_ONCE(src->flags);
+	dst->sport = READ_ONCE(src->sport);
+	dst->dport = READ_ONCE(src->dport);
+}
+
 static inline int ip_encap_hlen(struct ip_tunnel_encap *e)
 {
 	const struct ip_tunnel_encap_ops *ops;
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 63c524b080dd..6ca373d6205a 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1205,8 +1205,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield,
 		goto tx_err_dst_release;
 	}
 
-	/* Can tear, but hlen and build_header() use the same snapshot. */
-	ipencap = data_race(t->encap);
+	ip_tunnel_encap_snapshot(&ipencap, &t->encap);
 	encap_hlen = ip6_encap_hlen(&ipencap);
 	if (unlikely(encap_hlen < 0))
 		goto tx_err_dst_release;

[1] https://netdev-ai.bots.linux.dev/sashiko/#/patchset/99ba13458fbcff6d646ee223f0b70847b790777d.1787499036.git.petalzu987%40gmail.com
[2] https://lore.kernel.org/netdev/20260812120827.GA3410841@shredder/
[3] https://lore.kernel.org/netdev/20260817064250.GA196908@shredder/