[PATCH net v3 0/5] ip_tunnel, ip_gre: fix header length and validation bugs

[Eric Dumazet <edumazet@google.com>]

This series fixes netlink validation and header length accounting bugs
in ip_tunnel, ip6_tunnel, ip_gre, and ip6_gre:

1. Do not zero the active tunnel encapsulation in ip_tunnel_encap_setup()
   and ip6_tnl_encap_setup() before the new encapsulation has been
   validated.
2. Validate netlink attributes in ipgre_netlink_parms() and
   erspan_netlink_parms() into a temporary struct ip_gre_parm before
   mutating tunnel state, reject toggling IFLA_GRE_COLLECT_METADATA in
   changelink, and validate attributes before calling
   ipgre_newlink_encap_setup() in changelink.
3. Recompute GRE tunnel header lengths and MTU absolutely from tun_hlen
   and encap_hlen via ip_tunnel_refresh_lengths() rather than shifting by
   delta, fixing drift on encapsulation changes and hard_header_len
   corruption on gretap devices.
4. Recompute ERSPAN tunnel header lengths and MTU on changelink, reject
   non-zero GRE flags when IFLA_GRE_ERSPAN_VER is 0 or
   IFLA_GRE_COLLECT_METADATA is set, and ensure IP_TUNNEL_SEQ_BIT matches
   erspan_ver in erspan_xmit().
5. Reject malformed ERSPAN base header versions (ver != 1 && ver != 2)
   and skip ERSPAN metadata extraction for Type I frames in collect_md
   mode instead of copying inner Ethernet frame bytes into md->u.md2.

v3:
 - Patch 1: clarify commit message that callers still invoke
   ip[6]_tunnel_encap_setup() before validating the rest of changelink.
 - Patch 2: stage ignore_df, fwmark, erspan_ver, index, hwid, and dir into
   struct ip_gre_parm and commit after ip_tunnel_changelink() succeeds,
   reject toggling IFLA_GRE_COLLECT_METADATA in changelink, and parse
   netlink parms before ipgre_newlink_encap_setup() in changelink.
 - Patch 3: update old_hlen to the intermediate t->hlen when
   ip_tunnel_update() recomputes dev->mtu after a link or fwmark change so
   compensating encap + o_flags changes still refresh dev->mtu.
 - Patch 4: check IFLA_GRE_OFLAGS/IFLA_GRE_IFLAGS before the
   IFLA_GRE_ERSPAN_VER == 0 early return in erspan_validate(), ensure
   IP_TUNNEL_SEQ_BIT matches tunnel->erspan_ver in erspan_xmit(), and
   commit gparms + o_flags atomically after ip_tunnel_changelink() succeeds.
 - Patch 5: check tpi->proto == htons(ETH_P_ERSPAN) in is_erspan_type1(),
   and clarify commit message and comment that __iptunnel_pull_header()
   already linearized ETH_HLEN bytes of the inner Ethernet frame.
 - Link to v2: https://lore.kernel.org/netdev/20260916100155.1398403-1-edumazet@google.com/

v2:
 - Address Sashiko review feedback on v1.
 - Link to v1: https://lore.kernel.org/netdev/CANn89iJwwSMPXTjNYpXUskr1E+T8-EnkvO4LFSZAknqVL5+1gw@mail.gmail.com/

Assisted-by: LLM

Eric Dumazet (5):
  ip_tunnel: do not clear the active encap before validating the new one
  ip_gre: validate netlink attributes before changing the tunnel
  ip_gre: compute tunnel lengths absolutely instead of by delta
  ip_gre: recompute erspan header lengths after a change
  gre: do not read inner frame as erspan metadata in collect_md mode

 include/net/ip_tunnels.h |   1 +
 net/ipv4/ip_gre.c        | 296 ++++++++++++++++++++++++++++-----------
 net/ipv4/ip_tunnel.c     |  19 ++-
 net/ipv6/ip6_gre.c       |   2 +
 net/ipv6/ip6_tunnel.c    |   2 -
 5 files changed, 233 insertions(+), 87 deletions(-)

-- 
2.55.0.1082.g2b9226bbc0-goog