Re: [PATCH net v3 1/1] ip6_tunnel: snapshot encap in xmit

On Tue, Aug 25, 2026 at 03:29:49PM +0800, Ren Wei wrote:

From: Zixuan Chai <redacted>

ip6_tnl_changelink() can update encapsulation parameters while the
netdevice is transmitting packets. ip6_tnl_xmit() can calculate packet
headroom with t->encap_hlen and later build an encapsulation header from
the live t->encap. A concurrent update can change the encapsulation
header between these accesses and make skb_push() underflow the skb head.

Take a local snapshot of t->encap before calculating the encapsulation
header length. Use that same snapshot for headroom accounting, metadata
validation, and build_header(). This keeps all encapsulation decisions
for an skb consistent even if changelink updates the live configuration.

Fixes: b3a27b519b22 ("ip6_tunnel: Add support for fou/gue encapsulation")
Cc: stable@vger.kernel.org
Reported-by: Vega <redacted>
Assisted-by: Codex:gpt-5.4
Signed-off-by: Zixuan Chai <redacted>
Signed-off-by: Ren Wei <redacted>

The comment from Sashiko [1] (which I asked to review multiple times
[2][3]) looks valid. We need something like the diff below. The helper
can then be used in the IPv4 code.

diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h
index 7c9aadfe8fe3..97f3e9e3ccf5 100644
--- a/include/net/ip_tunnels.h
+++ b/include/net/ip_tunnels.h

@@ -522,6 +522,15 @@ skb_vlan_inet_prepare(struct sk_buff *skb, bool inner_proto_inherit)
 	return SKB_NOT_DROPPED_YET;
 }
 
+static inline void ip_tunnel_encap_snapshot(struct ip_tunnel_encap *dst,
+					    const struct ip_tunnel_encap *src)
+{
+	dst->type = READ_ONCE(src->type);
+	dst->flags = READ_ONCE(src->flags);
+	dst->sport = READ_ONCE(src->sport);
+	dst->dport = READ_ONCE(src->dport);
+}
+
 static inline int ip_encap_hlen(struct ip_tunnel_encap *e)
 {
 	const struct ip_tunnel_encap_ops *ops;

diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 63c524b080dd..6ca373d6205a 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c

@@ -1205,8 +1205,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield,
 		goto tx_err_dst_release;
 	}
 
-	/* Can tear, but hlen and build_header() use the same snapshot. */
-	ipencap = data_race(t->encap);
+	ip_tunnel_encap_snapshot(&ipencap, &t->encap);
 	encap_hlen = ip6_encap_hlen(&ipencap);
 	if (unlikely(encap_hlen < 0))
 		goto tx_err_dst_release;

[1] https://netdev-ai.bots.linux.dev/sashiko/#/patchset/99ba13458fbcff6d646ee223f0b70847b790777d.1787499036.git.petalzu987%40gmail.com
[2] https://lore.kernel.org/netdev/20260812120827.GA3410841@shredder/ (local)
[3] https://lore.kernel.org/netdev/20260817064250.GA196908@shredder/ (local)