Re: [PATCH v4 net-next] gre: fix ERSPAN o_flags race/corruption in xmit and fill_info

[Simon Horman <horms@kernel.org>]

On Wed, Aug 12, 2026 at 02:22:57PM +0000, Eric Dumazet wrote:
> For IPv4 ERSPAN:
> In erspan_xmit(), the driver clears IP_TUNNEL_SEQ_BIT (for version 0)
> and IP_TUNNEL_KEY_BIT directly in the shared tunnel->parms.o_flags
> structure. Since transmit paths can run locklessly and concurrently,
> this leads to a data race.
> 
> Furthermore, modifying tunnel->parms.o_flags permanently alters the
> tunnel configuration. To work around this, erspan_fill_info() (which
> reports config to userspace) was setting IP_TUNNEL_KEY_BIT back. If
> erspan_fill_info (running under RTNL) and erspan_xmit (running locklessly)
> race, erspan_xmit might see IP_TUNNEL_KEY_BIT set when it shouldn't,
> leading to GRE header corruption (injecting a key field into the ERSPAN
> GRE header).
> 
> Fix this by:
> 1) Passing flags as an argument to __gre_xmit().
> 2) Using local stack flags in ipgre_xmit(), gre_tap_xmit(), and erspan_xmit()
>    to prevent TOCTOU data races with concurrent configuration updates,
>    and passing them to __gre_xmit().
> 3) Removing the racy modification of t->parms.o_flags in erspan_fill_info().
> 4) Forcing IP_TUNNEL_KEY_BIT in the reported flags for ERSPAN locally
>    in ipgre_fill_info().
> 
> For IPv6 ERSPAN:
> ip6erspan_tunnel_xmit() was locklessly clearing IP_TUNNEL_KEY_BIT in
> t->parms.o_flags even though it does not use these flags for building
> the GRE header (it uses local flags). This permanently corrupts the
> configuration and races with ip6gre_fill_info() which reads it.
> 
> Remove the redundant and racy modification.
> This should remove false sharing in a fast path.
> 
> Add const qualifiers in ipgre_fill_info(), erspan_fill_info()
> and ip6gre_fill_info() to clarify that these methods are not
> supposed to write any live parameters.
> 
> Fixes: 84e54fe0a5ea ("gre: introduce native tunnel support for ERSPAN")
> Fixes: ee496694b9ee ("ip_gre: do not report erspan version on GRE interface")
> Fixes: 5a963eb61b7c ("ip6_gre: Add ERSPAN native tunnel support")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> ---
> v4: addressed sashiko's feedback.
> v3: https://lore.kernel.org/netdev/20260811095237.2314234-1-edumazet@google.com/
> v2: https://lore.kernel.org/netdev/20260720135132.3957146-1-edumazet@google.com/


Reviewed-by: Simon Horman <horms@kernel.org>