Re: [PATCH net] ip6_gre: check tunnel info before xmit in ip6gre_tunnel_xmit

[Ido Schimmel <idosch@nvidia.com>]

On Fri, Aug 28, 2026 at 10:37:31AM +0000, Eric Dumazet wrote:
> Shuangpeng Bai reported a KASAN slab-use-after-free in
> ip6gre_tunnel_xmit().
> 
> The precise KASAN bug was caused by ip6_tnl_xmit() consuming the
> skb during headroom expansion and returning an error, while
> ip6gre_tunnel_xmit() still held the stale pointer and called
> skb_tunnel_info_txcheck(skb) at tx_err. That specific bug was fixed by
> commit 87f21b59ddc6 ("ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()").
> 
> However, calling skb_tunnel_info_txcheck(skb) at the tx_err label
> after the transmission attempt remains problematic:
> 
> Downstream helpers like ip6_tnl_xmit() call skb_scrub_packet(),
> which drops the skb's metadata_dst before transmission. If an error
> occurs later during transmit, inspecting skb at tx_err sees a scrubbed
> dst and misclassifies tx_errors vs tx_dropped.
> 
> Commit e5f7e211b6aa ("ip6gre: avoid tx_error when sending MLD/DAD on
> external tunnels") already handled this correctly in
> ip6erspan_tunnel_xmit() by checking and caching tun_info before
> transmit.
> 
> Align ip6gre_tunnel_xmit() with ip6erspan_tunnel_xmit() by caching
> tun_info before xmit and checking it at tx_err.
> 
> Fixes: e5f7e211b6aa ("ip6gre: avoid tx_error when sending MLD/DAD on external tunnels")
> Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
> Closes: https://lore.kernel.org/netdev/20260819062224.3197349-1-shuangpeng.kernel@gmail.com/
> Cc: Davide Caratti <dcaratti@redhat.com>
> Signed-off-by: Eric Dumazet <edumazet@google.com>

Reviewed-by: Ido Schimmel <idosch@nvidia.com>