[PATCH net v3] net: dst_metadata: fix memcmp overread in skb_metadata_dst_cmp

[PATCH net v3] net: dst_metadata: fix memcmp overread in skb_metadata_dst_cmp

[Jean-Paul Sergent]

Commit 3fcece12bc1b6 ("net: store port/representator id in
metadata_dst") dropped the options_len equality check when converting
skb_metadata_dst_cmp() to a type switch, so the memcmp length is taken
from skb a alone.  When skb b carries fewer options than a, the
comparison reads past b's allocation.

Hit in practice with Cilium geneve GRO aggregation, comparing an skb
carrying 12 bytes of tunnel options against one carrying none:

  memcmp: detected buffer overflow: 108 byte read of buffer size 96
  WARNING: CPU: 0 PID: 15 at lib/string_helpers.c:1036 __fortify_report
   __fortify_panic+0x9/0x10
   skb_metadata_dst_cmp+0x11b/0x120
   dev_gro_receive+0x303/0x620
   gro_cell_poll+0x67/0xa0

Restore the check: unequal options_len means different metadata and no
aggregation; the memcmp only runs when both sides carry the same
options length.

Fixes: 3fcece12bc1b6 ("net: store port/representator id in metadata_dst")
Cc: stable@vger.kernel.org
Cc: Ilya Maximets <i.maximets@ovn.org>
Cc: Sasha Levin <sashal@kernel.org>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Eric Dumazet <edumazet@kernel.org>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: Simon Horman <horms@kernel.org>
Cc: Sridhar Samudrala <sridhar.samudrala@intel.com>
Cc: Kees Cook <kees@kernel.org>
Signed-off-by: Jean-Paul Sergent <jpsergent@gmail.com>
---
v3:
 - Restore options_len equality check as a one-liner; drop two-stage
   compare entirely (Ilya Maximets).
 - Update Fixes: tag to 3fcece12bc1b instead of 69050f8d6d07
   (Ilya Maximets, Sasha Levin).
 - Add author Signed-off-by, drop Reported-by (Ilya Maximets).
 - Drop redundant Closes: tag (Ilya Maximets).
 - Add maintainer Cc list via get_maintainer.pl (Ilya Maximets).
 - Remove superfluous in-code comments and trim commit log
   (Ilya Maximets).
v2: https://lore.kernel.org/netdev/20261003005449.2675.3@jpsergent.gmail.com/
 - Fix subject prefix to [PATCH net]; no code changes.
v1: https://lore.kernel.org/netdev/20261003005449.2675.2@jpsergent.gmail.com/
 include/net/dst_metadata.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/include/net/dst_metadata.h b/include/net/dst_metadata.h
index f45d1e3163f0..02fffbb85099 100644
--- a/include/net/dst_metadata.h
+++ b/include/net/dst_metadata.h
@@ -116,6 +116,8 @@ static inline int skb_metadata_dst_cmp(const struct sk_buff *skb_a,
 		return memcmp(&a->u.port_info, &b->u.port_info,
 			      sizeof(a->u.port_info));
 	case METADATA_IP_TUNNEL:
+		if (a->u.tun_info.options_len != b->u.tun_info.options_len)
+			return 1;
 		return memcmp(&a->u.tun_info, &b->u.tun_info,
 			      sizeof(a->u.tun_info) +
 					 a->u.tun_info.options_len);
-- 
2.56.0

Re: [PATCH net v3] net: dst_metadata: fix memcmp overread in skb_metadata_dst_cmp

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:

On Mon,  9 Nov 2026 00:24:10 -0800 you wrote:
> Commit 3fcece12bc1b6 ("net: store port/representator id in
> metadata_dst") dropped the options_len equality check when converting
> skb_metadata_dst_cmp() to a type switch, so the memcmp length is taken
> from skb a alone.  When skb b carries fewer options than a, the
> comparison reads past b's allocation.
> 
> Hit in practice with Cilium geneve GRO aggregation, comparing an skb
> carrying 12 bytes of tunnel options against one carrying none:
> 
> [...]

Here is the summary with links:
  - [net,v3] net: dst_metadata: fix memcmp overread in skb_metadata_dst_cmp
    https://git.kernel.org/netdev/net/c/74a7db839308

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html