Re: [PATCH net v2] net/sched: cls_flower: exact-match ERSPAN key when no mask supplied

[Simon Horman <horms@kernel.org>]

On Thu, Sep 24, 2026 at 08:18:41AM -0400, Jamal Hadi Salim wrote:
> Commit 292207809486 ("net: sched: fix erspan_opt settings in cls_flower")
> removed the unconditional memset of the erspan_metadata mask in
> fl_set_erspan_opt(). On the mask-parse pass, when userspace supplies the
> encap option key but no mask (TCA_FLOWER_KEY_ENC_OPTS without
> TCA_FLOWER_KEY_ENC_OPTS_MASK), the !depth early return leaves the mask
> zeroed -- a wildcard. A filter keyed on an ERSPAN index (v1), or dir/hwid
> (v2), then matches every ERSPAN packet's values instead of exact-matching.
> 
> Default the match fields on the no-mask path the same way the with-mask
> branches default them: v1 index to 0xff, v2 dir and hwid to their
> exact-match masks. The union cannot just be memset to 0xff -- that would
> re-mask the overlapping timestamp/sgt bytes of the v2 header that the
> commit deliberately left to 0.
> 
> A mask and a key that declare different ERSPAN versions describe different
> union layouts, so the mask would silently wildcard the key's matched
> fields. Reject that combination. Have fl_set_erspan_opt() report the
> parsed key's version back through a u8 pointer so the mask pass uses it
> without re-reading the union.
> 
> This is a follow-up to commit fee10655709c ("net/sched: cls_flower:
> validate mask pointer after nla_next()").
> 
> Conditions to recreate the bug: add an ERSPAN encap-opts flower filter
> with a key but no mask (raw netlink, TCA_FLOWER_KEY_ENC_OPTS present,
> TCA_FLOWER_KEY_ENC_OPTS_MASK absent); dump the filter and observe the
> match mask is zero (wildcard) instead of exact for the supplied fields.
> For the mismatch case, pair a v1 key with a v2 mask (or vice versa) and
> observe the request is accepted with a mask of the other version.
> 
> Fixes: 292207809486 ("net: sched: fix erspan_opt settings in cls_flower")
> Reported-by: Sashiko (gemini) <sashiko-bot@kernel.org>
> Closes: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260826025123.62758-1-ljp1205831794@gmail.com
> Link: https://lore.kernel.org/netdev/20260826025123.62758-1-ljp1205831794@gmail.com/
> Reported-by: Sashiko (nipa) <sashiko-bot@kernel.org>
> Link: https://lore.kernel.org/netdev/179003833955.2160803.1077681716391858800@kernel.org/
> Suggested-by: Xin Long <lucien.xin@gmail.com>
> Tested-by: hybris <hybris@mojatatu.ai>
> Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
> ---
> v1 -> v2:
> - Scope the key's version default to the no-mask path only. v1 assigned
>   the key's version to the mask unconditionally, which changed the
>   with-mask parse path for a mask nest that declared no version (nipa M1).
> - Reject a mask whose declared version differs from the key's; the two
>   versions index different union layouts, so the mismatch silently
>   wildcarded the key's matched fields (nipa M2).
> - Set the key's parsed version through a u8 pointer argument rather than
>   re-reading it from the union at the call site (Xin Long).

Reviewed-by: Simon Horman <horms@kernel.org>