[PATCH net] ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()

[PATCH net] ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()

[Eric Dumazet]

In vti6_tnl_lookup(), when an exact match for a tunnel fails,
the code falls back to searching for wildcard tunnels:

- Tunnels matching the packet's local address, with any remote address
  wildcard remote).

- Tunnels matching the packet's remote address, with any local address
  (wildcard local).

However, vti6 stores all these different types of tunnels in the same
hash table (ip6n->tnls_r_l) prone to hash collisions.

The bug is that the fallback search loops in vti6_tnl_lookup() were
missing checks to ensure that the candidate tunnel actually has
a wildcard address.

Fixes: fbe68ee87522 ("vti6: Add a lookup method for tunnels with wildcard endpoints.")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
---
 net/ipv6/ip6_vti.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index df793c8bfffb0a26ea7f54933b88bccc9b1aa495..8b2c59c8eb27ea659615c8894d8f5e37e7298870 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -106,6 +106,7 @@ vti6_tnl_lookup(struct net *net, const struct in6_addr *remote,
 	hash = HASH(&any, local);
 	for_each_vti6_tunnel_rcu(ip6n->tnls_r_l[hash]) {
 		if (ipv6_addr_equal(local, &t->parms.laddr) &&
+		    ipv6_addr_any(&t->parms.raddr) &&
 		    (t->dev->flags & IFF_UP))
 			return t;
 	}
@@ -113,6 +114,7 @@ vti6_tnl_lookup(struct net *net, const struct in6_addr *remote,
 	hash = HASH(remote, &any);
 	for_each_vti6_tunnel_rcu(ip6n->tnls_r_l[hash]) {
 		if (ipv6_addr_equal(remote, &t->parms.raddr) &&
+		    ipv6_addr_any(&t->parms.laddr) &&
 		    (t->dev->flags & IFF_UP))
 			return t;
 	}
-- 
2.54.0.1064.gd145956f57-goog

Re: [PATCH net] ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()

[Nicolas Dichtel]

Le 08/06/2026 à 18:46, Eric Dumazet a écrit :
> In vti6_tnl_lookup(), when an exact match for a tunnel fails,
> the code falls back to searching for wildcard tunnels:
> 
> - Tunnels matching the packet's local address, with any remote address
>   wildcard remote).
> 
> - Tunnels matching the packet's remote address, with any local address
>   (wildcard local).
> 
> However, vti6 stores all these different types of tunnels in the same
> hash table (ip6n->tnls_r_l) prone to hash collisions.
> 
> The bug is that the fallback search loops in vti6_tnl_lookup() were
> missing checks to ensure that the candidate tunnel actually has
> a wildcard address.
> 
> Fixes: fbe68ee87522 ("vti6: Add a lookup method for tunnels with wildcard endpoints.")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Cc: Steffen Klassert <steffen.klassert@secunet.com>

Reviewed-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>

Re: [PATCH net] ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Mon,  8 Jun 2026 16:46:13 +0000 you wrote:
> In vti6_tnl_lookup(), when an exact match for a tunnel fails,
> the code falls back to searching for wildcard tunnels:
> 
> - Tunnels matching the packet's local address, with any remote address
>   wildcard remote).
> 
> - Tunnels matching the packet's remote address, with any local address
>   (wildcard local).
> 
> [...]

Here is the summary with links:
  - [net] ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
    https://git.kernel.org/netdev/net/c/a5c0359f5cbc

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html