[PATCH net] ip6_gre: check tunnel info before xmit in ip6gre_tunnel_xmit

[PATCH net] ip6_gre: check tunnel info before xmit in ip6gre_tunnel_xmit

[Eric Dumazet]

Shuangpeng Bai reported a KASAN slab-use-after-free in
ip6gre_tunnel_xmit().

The precise KASAN bug was caused by ip6_tnl_xmit() consuming the
skb during headroom expansion and returning an error, while
ip6gre_tunnel_xmit() still held the stale pointer and called
skb_tunnel_info_txcheck(skb) at tx_err. That specific bug was fixed by
commit 87f21b59ddc6 ("ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()").

However, calling skb_tunnel_info_txcheck(skb) at the tx_err label
after the transmission attempt remains problematic:

Downstream helpers like ip6_tnl_xmit() call skb_scrub_packet(),
which drops the skb's metadata_dst before transmission. If an error
occurs later during transmit, inspecting skb at tx_err sees a scrubbed
dst and misclassifies tx_errors vs tx_dropped.

Commit e5f7e211b6aa ("ip6gre: avoid tx_error when sending MLD/DAD on
external tunnels") already handled this correctly in
ip6erspan_tunnel_xmit() by checking and caching tun_info before
transmit.

Align ip6gre_tunnel_xmit() with ip6erspan_tunnel_xmit() by caching
tun_info before xmit and checking it at tx_err.

Fixes: e5f7e211b6aa ("ip6gre: avoid tx_error when sending MLD/DAD on external tunnels")
Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
Closes: https://lore.kernel.org/netdev/20260819062224.3197349-1-shuangpeng.kernel@gmail.com/
Cc: Davide Caratti <dcaratti@redhat.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
---
 net/ipv6/ip6_gre.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 69c51f1a5bf08b912a4efd1969d3b0ac5df5aa02..8ebda0b6a78b2236b439f5499d84f34f652fcbe2 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -878,6 +878,7 @@ static int ip6gre_xmit_other(struct sk_buff *skb, struct net_device *dev)
 static netdev_tx_t ip6gre_tunnel_xmit(struct sk_buff *skb,
 	struct net_device *dev)
 {
+	struct ip_tunnel_info *tun_info = NULL;
 	struct ip6_tnl *t = netdev_priv(dev);
 	__be16 payload_protocol;
 	int ret;
@@ -888,6 +889,9 @@ static netdev_tx_t ip6gre_tunnel_xmit(struct sk_buff *skb,
 	if (!ip6_tnl_xmit_ctl(t, &t->parms.laddr, &t->parms.raddr))
 		goto tx_err;
 
+	if (t->parms.collect_md)
+		tun_info = skb_tunnel_info_txcheck(skb);
+
 	payload_protocol = skb_protocol(skb, true);
 	switch (payload_protocol) {
 	case htons(ETH_P_IP):
@@ -907,7 +911,7 @@ static netdev_tx_t ip6gre_tunnel_xmit(struct sk_buff *skb,
 	return NETDEV_TX_OK;
 
 tx_err:
-	if (!t->parms.collect_md || !IS_ERR(skb_tunnel_info_txcheck(skb)))
+	if (!IS_ERR(tun_info))
 		DEV_STATS_INC(dev, tx_errors);
 	DEV_STATS_INC(dev, tx_dropped);
 	kfree_skb(skb);
-- 
2.55.0.897.gb25b4bd76c-goog

Re: [PATCH net] ip6_gre: check tunnel info before xmit in ip6gre_tunnel_xmit

[Ido Schimmel]

On Fri, Aug 28, 2026 at 10:37:31AM +0000, Eric Dumazet wrote:
> Shuangpeng Bai reported a KASAN slab-use-after-free in
> ip6gre_tunnel_xmit().
> 
> The precise KASAN bug was caused by ip6_tnl_xmit() consuming the
> skb during headroom expansion and returning an error, while
> ip6gre_tunnel_xmit() still held the stale pointer and called
> skb_tunnel_info_txcheck(skb) at tx_err. That specific bug was fixed by
> commit 87f21b59ddc6 ("ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()").
> 
> However, calling skb_tunnel_info_txcheck(skb) at the tx_err label
> after the transmission attempt remains problematic:
> 
> Downstream helpers like ip6_tnl_xmit() call skb_scrub_packet(),
> which drops the skb's metadata_dst before transmission. If an error
> occurs later during transmit, inspecting skb at tx_err sees a scrubbed
> dst and misclassifies tx_errors vs tx_dropped.
> 
> Commit e5f7e211b6aa ("ip6gre: avoid tx_error when sending MLD/DAD on
> external tunnels") already handled this correctly in
> ip6erspan_tunnel_xmit() by checking and caching tun_info before
> transmit.
> 
> Align ip6gre_tunnel_xmit() with ip6erspan_tunnel_xmit() by caching
> tun_info before xmit and checking it at tx_err.
> 
> Fixes: e5f7e211b6aa ("ip6gre: avoid tx_error when sending MLD/DAD on external tunnels")
> Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
> Closes: https://lore.kernel.org/netdev/20260819062224.3197349-1-shuangpeng.kernel@gmail.com/
> Cc: Davide Caratti <dcaratti@redhat.com>
> Signed-off-by: Eric Dumazet <edumazet@google.com>

Reviewed-by: Ido Schimmel <idosch@nvidia.com>

Re: [PATCH net] ip6_gre: check tunnel info before xmit in ip6gre_tunnel_xmit

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Fri, 28 Aug 2026 10:37:31 +0000 you wrote:
> Shuangpeng Bai reported a KASAN slab-use-after-free in
> ip6gre_tunnel_xmit().
> 
> The precise KASAN bug was caused by ip6_tnl_xmit() consuming the
> skb during headroom expansion and returning an error, while
> ip6gre_tunnel_xmit() still held the stale pointer and called
> skb_tunnel_info_txcheck(skb) at tx_err. That specific bug was fixed by
> commit 87f21b59ddc6 ("ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()").
> 
> [...]

Here is the summary with links:
  - [net] ip6_gre: check tunnel info before xmit in ip6gre_tunnel_xmit
    https://git.kernel.org/netdev/net/c/97cc84dad1d7

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html