Re: [PATCH net-next] gre: fix ERSPAN o_flags race/corruption in xmit and fill_info
From: Ido Schimmel <idosch@nvidia.com>
Date: 2026-06-17 06:34:34
On Mon, Jun 15, 2026 at 02:03:33PM +0000, Eric Dumazet wrote:
quoted hunk ↗ jump to hunk
@@ -692,7 +689,7 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb, tunnel->parms.o_flags))) goto free_skb; - __gre_xmit(skb, dev, tnl_params, skb->protocol); + __gre_xmit(skb, dev, tnl_params, skb->protocol, tunnel->parms.o_flags); return NETDEV_TX_OK; free_skb:@@ -705,6 +702,7 @@ static netdev_tx_t erspan_xmit(struct sk_buff *skb, struct net_device *dev) { struct ip_tunnel *tunnel = netdev_priv(dev); + IP_TUNNEL_DECLARE_FLAGS(flags); bool truncate = false; __be16 proto;@@ -728,10 +726,12 @@ static netdev_tx_t erspan_xmit(struct sk_buff *skb, truncate = true; } + ip_tunnel_flags_copy(flags, tunnel->parms.o_flags); + /* Push ERSPAN header */ if (tunnel->erspan_ver == 0) { proto = htons(ETH_P_ERSPAN); - __clear_bit(IP_TUNNEL_SEQ_BIT, tunnel->parms.o_flags); + __clear_bit(IP_TUNNEL_SEQ_BIT, flags); } else if (tunnel->erspan_ver == 1) { erspan_build_header(skb, ntohl(tunnel->parms.o_key), tunnel->index,@@ -746,8 +746,8 @@ static netdev_tx_t erspan_xmit(struct sk_buff *skb, goto free_skb; } - __clear_bit(IP_TUNNEL_KEY_BIT, tunnel->parms.o_flags); - __gre_xmit(skb, dev, &tunnel->parms.iph, proto); + __clear_bit(IP_TUNNEL_KEY_BIT, flags); + __gre_xmit(skb, dev, &tunnel->parms.iph, proto, flags); return NETDEV_TX_OK; free_skb:@@ -776,7 +776,7 @@ static netdev_tx_t gre_tap_xmit(struct sk_buff *skb, if (skb_cow_head(skb, dev->needed_headroom)) goto free_skb; - __gre_xmit(skb, dev, &tunnel->parms.iph, htons(ETH_P_TEB)); + __gre_xmit(skb, dev, &tunnel->parms.iph, htons(ETH_P_TEB), tunnel->parms.o_flags);
Eric, did you see the feedback from Sashiko [1]? WDYT about aligning ipgre and gretap with erspan and passing a copy of the output flags to __gre_xmit() instead of passing 'tunnel->parms.o_flags' directly? The mismatch between the output flags and the tunnel header length is a different issue (pre-existing). [1] https://sashiko.dev/#/patchset/20260615140333.3161072-1-edumazet%40google.com
return NETDEV_TX_OK; free_skb: