Thread (4 messages) flat view 4 messages, 4 authors, 8d ago

Re: [PATCH net v2] net: ip_tunnel: initialize `options_len` before referencing options

From: patchwork-bot+netdevbpf@kernel.org
Date: 2026-09-16 00:51:11
Also in: linux-hardening, lkml, stable

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski [off-list ref]:

On Sun, 13 Sep 2026 17:08:50 +0800 you wrote:
The following command triggers a kernel panic:

  ip link add d0 type dummy; ip link set d0 up
  ip route add 10.30.0.0/16 \
    encap ip id 300 geneve_opts 4660:66:11223344 dev d0

  memcpy: detected buffer overflow: 4 byte write of buffer size 0
  kernel BUG at lib/string_helpers.c:1044!
  ...
  ip_tun_parse_opts.part.0.cold+0x10/0x10
  ip_tun_build_state+0x116/0x2a0

[...]
Here is the summary with links:
  - [net,v2] net: ip_tunnel: initialize `options_len` before referencing options
    https://git.kernel.org/netdev/net/c/455ebeadf714

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help