From: Ido Schimmel <idosch@nvidia.com>
To: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>
Cc: netdev@vger.kernel.org, "David S . Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@kernel.org>,
Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
Simon Horman <horms@kernel.org>, David Ahern <dsahern@kernel.org>,
William Tu <u9012063@gmail.com>,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH net-next 1/2] erspan: drop packets with an unknown ERSPAN version
Date: Tue, 20 Oct 2026 20:15:55 +0300 [thread overview]
Message-ID: <20261020171555.GA3236673@shredder> (raw)
In-Reply-To: <20261018090236.2487997-2-yanhaishuang@cmss.chinamobile.com>
On Sun, Oct 18, 2026 at 05:02:35PM +0800, Haishuang Yan wrote:
> The ERSPAN type II and III receive paths take the length of the ERSPAN
> header from the version field of the packet, with erspan_hdr_len(), but
> never check that the version is one they know: 1 for type II or 2 for
> type III.
>
> For any other version, erspan_hdr_len() returns 0 or the type III
> length. With version 0, the ERSPAN header is not pulled at all, so it
> is passed up as the start of the inner Ethernet frame, and in collect_md
> mode the metadata is copied from 8 bytes after the base header, which
> pskb_may_pull() did not cover.
__iptunnel_pull_header() drops the packet if it can't pull the Ethernet
header of the encapsulated packet, so there's no memory safety issue
here. Only reading metadata from the wrong place.
>
> Reject such packets, as a packet with a truncated ERSPAN header already
> is.
>
> Fixes: f551c91de262 ("net: erspan: introduce erspan v2 for ip_gre")
> Fixes: 94d7d8f29287 ("ip6_gre: add erspan v2 support")
Given that this never worked and that there's no security issue here,
drop these tags and target v2 at net-next when it re-opens.
>
> Signed-off-by: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>
next prev parent reply other threads:[~2026-10-20 17:16 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-18 9:02 [PATCH net-next 0/2] erspan: fix two header parsing issues on receive Haishuang Yan
2026-10-18 9:02 ` [PATCH net-next 1/2] erspan: drop packets with an unknown ERSPAN version Haishuang Yan
2026-10-20 17:15 ` Ido Schimmel [this message]
2026-10-18 9:02 ` [PATCH net-next 2/2] erspan: skip the platform specific sub-header of ERSPAN type III Haishuang Yan
2026-10-20 17:16 ` Ido Schimmel
2026-10-18 9:09 ` [PATCH net-next 0/2] erspan: fix two header parsing issues on receive netdev-bot+sinfo
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261020171555.GA3236673@shredder \
--to=idosch@nvidia.com \
--cc=davem@davemloft.net \
--cc=dsahern@kernel.org \
--cc=edumazet@kernel.org \
--cc=horms@kernel.org \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=u9012063@gmail.com \
--cc=yanhaishuang@cmss.chinamobile.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.