Re: [PATCH v3 net-next] gre: fix ERSPAN o_flags race/corruption in xmit and fill_info

On Tue, Aug 11, 2026 at 11:52 AM Eric Dumazet <[email protected]> wrote:
>
> For IPv4 ERSPAN:
> In erspan_xmit(), the driver clears IP_TUNNEL_SEQ_BIT (for version 0)
> and IP_TUNNEL_KEY_BIT directly in the shared tunnel->parms.o_flags
> structure. Since transmit paths can run locklessly and concurrently,
> this leads to a data race.
>
> Furthermore, modifying tunnel->parms.o_flags permanently alters the
> tunnel configuration. To work around this, erspan_fill_info() (which
> reports config to userspace) was setting IP_TUNNEL_KEY_BIT back. If
> erspan_fill_info (running under RTNL) and erspan_xmit (running locklessly)
> race, erspan_xmit might see IP_TUNNEL_KEY_BIT set when it shouldn't,
> leading to GRE header corruption (injecting a key field into the ERSPAN
> GRE header).
>
> Fix this by:
> 1) Passing flags as an argument to __gre_xmit().
> 2) Using local flags in erspan_xmit() and passing them to __gre_xmit().
> 3) Removing the racy modification of t->parms.o_flags in erspan_fill_info().
> 4) Forcing IP_TUNNEL_KEY_BIT in the reported flags for ERSPAN locally
>    in ipgre_fill_info().

It seems sashiko found one issue, a V4 is needed.

https://sashiko.dev/#/patchset/20260811095237.2314234-1-edumazet%40google.com

pw-bot: cr