net: ip_tunnel: initialize `options_len` before referencing options

PATCH Applied Gris Ge 4 participants 4 messages Sep 13 – Sep 16

Subsystems (4)

Networking Network drivers Stable branch IPv4/IPv6

lore

Share & tools

lore

Gris Ge

author

2026-09-13 09:09 UTC #0 lore raw

PATCH v2 1/1 net: ip_tunnel: initialize `options_len` before referencing options

The following command triggers a kernel panic:

ip link add d0 type dummy; ip link set d0 up

  ip route add 10.30.0.0/16 \
    encap ip id 300 geneve_opts 4660:66:11223344 dev d0

memcpy: detected buffer overflow: 4 byte write of buffer size 0 kernel BUG at lib/string_helpers.c:1044!
...

  ip_tun_parse_opts.part.0.cold+0x10/0x10
  ip_tun_build_state+0x116/0x2a0

On kernels built with GCC 15+ and CONFIG_FORTIFY_SOURCE, the fortified memcpy() got 0 sized destination with request of 4 bytes length:

  static int ip_tun_parse_opts_geneve(...)
  {
      ...
      attr = tb[LWTUNNEL_IP_OPT_GENEVE_DATA];
      data_len = nla_len(attr); /* == 4 */

      struct geneve_opt *opt = ip_tunnel_info_opts(info) + opts_len;
      memcpy(opt->opt_data, nla_data(attr), data_len);
      /*     ^^^^^^^^^^^^^ 0 since options_len is assigned afterwards */

Fixed by initializing the counter before the options are referenced. Matching what tunnel_key_opts_set() already does.

Fixes bb5e62f2d547 ("net: Add options as a flexible array to struct ip_tunnel_info")

Cc [email protected]

Signed-off-by Gris Ge <[email protected]>

---
v2:
- pass opt_len into ip_tun_set_opts() and initialize options_len there, matching tunnel_key_opts_set(), as suggested by Eric Dumazet.
v1: https://lore.kernel.org/netdev/[email protected]/

 net/ipv4/ip_tunnel_core.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

net/ipv4/ip_tunnel_core.c +11 -5

index 5168d546ea2f..bab42b9e277f 100644
@@ -680,8 +680,14 @@ static int ip_tun_get_optlen(struct nlattr *attr,
 }
 
 static int ip_tun_set_opts(struct nlattr *attr, struct ip_tunnel_info *info,
-			   struct netlink_ext_ack *extack)
+			   int opts_len, struct netlink_ext_ack *extack)
 {
+	/* `options_len` is the __counted_by() annotation of the `options`
+	 * flexible array, it must be initialized before parsing writes
+	 * into it.
+	 */
+	info->options_len = opts_len;
+
 	return ip_tun_parse_opts(attr, info, extack);
 }

@@ -712,7 +718,8 @@ static int ip_tun_build_state(struct net *net, struct nlattr *attr,
 
 	tun_info = lwt_tun_info(new_state);
 
-	err = ip_tun_set_opts(tb[LWTUNNEL_IP_OPTS], tun_info, extack);
+	err = ip_tun_set_opts(tb[LWTUNNEL_IP_OPTS], tun_info, opt_len,
+			      extack);
 	if (err < 0) {
 		lwtstate_free(new_state);
 		return err;

@@ -753,7 +760,6 @@ static int ip_tun_build_state(struct net *net, struct nlattr *attr,
 	}
 
 	tun_info->mode = IP_TUNNEL_INFO_TX;
-	tun_info->options_len = opt_len;
 
 	*ts = new_state;

@@ -1006,7 +1012,8 @@ static int ip6_tun_build_state(struct net *net, struct nlattr *attr,
 
 	tun_info = lwt_tun_info(new_state);
 
-	err = ip_tun_set_opts(tb[LWTUNNEL_IP6_OPTS], tun_info, extack);
+	err = ip_tun_set_opts(tb[LWTUNNEL_IP6_OPTS], tun_info, opt_len,
+			      extack);
 	if (err < 0) {
 		lwtstate_free(new_state);
 		return err;

@@ -1040,7 +1047,6 @@ static int ip6_tun_build_state(struct net *net, struct nlattr *attr,
 	}
 
 	tun_info->mode = IP_TUNNEL_INFO_TX | IP_TUNNEL_INFO_IPV6;
-	tun_info->options_len = opt_len;
 
 	*ts = new_state;

--
2.55.0

Hangbin Liu

Reviewed-by on v2 1/1

2026-09-14 01:36 UTC #1 lore raw

Quoted 97 lines · Gris Ge

The following command triggers a kernel panic:

ip link add d0 type dummy; ip link set d0 up

  ip route add 10.30.0.0/16 \
    encap ip id 300 geneve_opts 4660:66:11223344 dev d0

memcpy: detected buffer overflow: 4 byte write of buffer size 0 kernel BUG at lib/string_helpers.c:1044!
...

  ip_tun_parse_opts.part.0.cold+0x10/0x10
  ip_tun_build_state+0x116/0x2a0

On kernels built with GCC 15+ and CONFIG_FORTIFY_SOURCE, the fortified memcpy() got 0 sized destination with request of 4 bytes length:

  static int ip_tun_parse_opts_geneve(...)
  {
      ...
      attr = tb[LWTUNNEL_IP_OPT_GENEVE_DATA];
      data_len = nla_len(attr); /* == 4 */

      struct geneve_opt *opt = ip_tunnel_info_opts(info) + opts_len;
      memcpy(opt->opt_data, nla_data(attr), data_len);
      /*     ^^^^^^^^^^^^^ 0 since options_len is assigned afterwards */

Fixed by initializing the counter before the options are referenced. Matching what tunnel_key_opts_set() already does.

Fixes bb5e62f2d547 ("net: Add options as a flexible array to struct ip_tunnel_info")

Cc [email protected]

Signed-off-by Gris Ge <[email protected]>

 net/ipv4/ip_tunnel_core.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

net/ipv4/ip_tunnel_core.c +11 -6

index 5168d546ea2f..bab42b9e277f 100644
@@ -680,8 +680,14 @@ static int ip_tun_get_optlen(struct nlattr *attr,
 }
 
 static int ip_tun_set_opts(struct nlattr *attr, struct ip_tunnel_info *info,
-			   struct netlink_ext_ack *extack)
+			   int opts_len, struct netlink_ext_ack *extack)
 {
+	/* `options_len` is the __counted_by() annotation of the `options`
+	 * flexible array, it must be initialized before parsing writes
+	 * into it.
+	 */
+	info->options_len = opts_len;
+
 	return ip_tun_parse_opts(attr, info, extack);
 }

@@ -712,7 +718,8 @@ static int ip_tun_build_state(struct net *net, struct nlattr *attr,
 
 	tun_info = lwt_tun_info(new_state);
 
-	err = ip_tun_set_opts(tb[LWTUNNEL_IP_OPTS], tun_info, extack);
+	err = ip_tun_set_opts(tb[LWTUNNEL_IP_OPTS], tun_info, opt_len,
+			      extack);
 	if (err < 0) {
 		lwtstate_free(new_state);
 		return err;

@@ -753,7 +760,6 @@ static int ip_tun_build_state(struct net *net, struct nlattr *attr,
 	}
 
 	tun_info->mode = IP_TUNNEL_INFO_TX;
-	tun_info->options_len = opt_len;
 
 	*ts = new_state;

@@ -1006,7 +1012,8 @@ static int ip6_tun_build_state(struct net *net, struct nlattr *attr,
 
 	tun_info = lwt_tun_info(new_state);
 
-	err = ip_tun_set_opts(tb[LWTUNNEL_IP6_OPTS], tun_info, extack);
+	err = ip_tun_set_opts(tb[LWTUNNEL_IP6_OPTS], tun_info, opt_len,
+			      extack);
 	if (err < 0) {
 		lwtstate_free(new_state);
 		return err;

@@ -1040,7 +1047,6 @@ static int ip6_tun_build_state(struct net *net, struct nlattr *attr,
 	}
 
 	tun_info->mode = IP_TUNNEL_INFO_TX | IP_TUNNEL_INFO_IPV6;
-	tun_info->options_len = opt_len;
 
 	*ts = new_state;
 
--

Quoted 2 lines

2.55.0

Looks good to me.

Reviewed-by Hangbin Liu <[email protected]>

Gustavo A. R. Silva

Reviewed-by on v2 1/1

2026-09-14 05:42 UTC #2 lore raw

In reply to Gris Ge

Quoted 25 lines · Gris Ge

The following command triggers a kernel panic:

   ip link add d0 type dummy; ip link set d0 up
   ip route add 10.30.0.0/16 \
     encap ip id 300 geneve_opts 4660:66:11223344 dev d0

   memcpy: detected buffer overflow: 4 byte write of buffer size 0
   kernel BUG at lib/string_helpers.c:1044!
   ...
   ip_tun_parse_opts.part.0.cold+0x10/0x10
   ip_tun_build_state+0x116/0x2a0

On kernels built with GCC 15+ and CONFIG_FORTIFY_SOURCE, the fortified memcpy() got 0 sized destination with request of 4 bytes length:

   static int ip_tun_parse_opts_geneve(...)
   {
       ...
       attr = tb[LWTUNNEL_IP_OPT_GENEVE_DATA];
       data_len = nla_len(attr); /* == 4 */

       struct geneve_opt *opt = ip_tunnel_info_opts(info) + opts_len;
       memcpy(opt->opt_data, nla_data(attr), data_len);
       /*     ^^^^^^^^^^^^^ 0 since options_len is assigned afterwards */

Quoted 6 lines

Fixed by initializing the counter before the options are referenced. Matching what tunnel_key_opts_set() already does.
Fixes bb5e62f2d547 ("net: Add options as a flexible array to struct ip_tunnel_info")
Cc [email protected]
Signed-off-by Gris Ge <[email protected]>

Reviewed-by Gustavo A. R. Silva <[email protected]>

Thanks
-Gustavo

Quoted 68 lines

  net/ipv4/ip_tunnel_core.c | 16 +++++++++++-----
  1 file changed, 11 insertions(+), 5 deletions(-)

net/ipv4/ip_tunnel_core.c +11 -6

index 5168d546ea2f..bab42b9e277f 100644
@@ -680,8 +680,14 @@ static int ip_tun_get_optlen(struct nlattr *attr,
  }
 
  static int ip_tun_set_opts(struct nlattr *attr, struct ip_tunnel_info *info,
-			   struct netlink_ext_ack *extack)
+			   int opts_len, struct netlink_ext_ack *extack)
  {
+	/* `options_len` is the __counted_by() annotation of the `options`
+	 * flexible array, it must be initialized before parsing writes
+	 * into it.
+	 */
+	info->options_len = opts_len;
+
  	return ip_tun_parse_opts(attr, info, extack);
  }

@@ -712,7 +718,8 @@ static int ip_tun_build_state(struct net *net, struct nlattr *attr,
 
  	tun_info = lwt_tun_info(new_state);
 
-	err = ip_tun_set_opts(tb[LWTUNNEL_IP_OPTS], tun_info, extack);
+	err = ip_tun_set_opts(tb[LWTUNNEL_IP_OPTS], tun_info, opt_len,
+			      extack);
  	if (err < 0) {
  		lwtstate_free(new_state);
  		return err;

@@ -753,7 +760,6 @@ static int ip_tun_build_state(struct net *net, struct nlattr *attr,
  	}
 
  	tun_info->mode = IP_TUNNEL_INFO_TX;
-	tun_info->options_len = opt_len;
 
  	*ts = new_state;

@@ -1006,7 +1012,8 @@ static int ip6_tun_build_state(struct net *net, struct nlattr *attr,
 
  	tun_info = lwt_tun_info(new_state);
 
-	err = ip_tun_set_opts(tb[LWTUNNEL_IP6_OPTS], tun_info, extack);
+	err = ip_tun_set_opts(tb[LWTUNNEL_IP6_OPTS], tun_info, opt_len,
+			      extack);
  	if (err < 0) {
  		lwtstate_free(new_state);
  		return err;

@@ -1040,7 +1047,6 @@ static int ip6_tun_build_state(struct net *net, struct nlattr *attr,
  	}
 
  	tun_info->mode = IP_TUNNEL_INFO_TX | IP_TUNNEL_INFO_IPV6;
-	tun_info->options_len = opt_len;
 
  	*ts = new_state;
 
--

2.55.0

[email protected]

CI Applied

2026-09-16 00:51 UTC #3 lore raw

In reply to Gris Ge

This patch was applied to netdev/net.git (main) by Jakub Kicinski <[email protected]>:

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <[email protected]>:

Quoted 6 lines · On Sun, 13 Sep 2026 17:08:50 +0800 you wrote:

The following command triggers a kernel panic:
ip link add d0 type dummy; ip link set d0 up
  ip route add 10.30.0.0/16 \
    encap ip id 300 geneve_opts 4660:66:11223344 dev d0

Quoted 7 lines

memcpy: detected buffer overflow: 4 byte write of buffer size 0 kernel BUG at lib/string_helpers.c:1044!
...
  ip_tun_parse_opts.part.0.cold+0x10/0x10
  ip_tun_build_state+0x116/0x2a0
[...]

Here is the summary with links:
- [net,v2] net: ip_tunnel: initialize options_len before referencing options

    https://git.kernel.org/netdev/net/c/455ebeadf714

You are awesome, thank you!

Signature · 2 lines

Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html