[PATCH net v2 4/5] ip_gre: recompute erspan header lengths after a change
From: Eric Dumazet <edumazet@google.com>
Date: 2026-09-16 10:02:02
Subsystem:
networking [general], networking [ipv4/ipv6], the rest · Maintainers:
"David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, David Ahern, Ido Schimmel, Linus Torvalds
erspan_tunnel_init() is the only place computing tunnel->tun_hlen and
tunnel->hlen, but erspan_changelink() can change both: tunnel->erspan_ver
selects a 4 or 8 byte GRE header and feeds erspan_hdr_len(), while
ip_tunnel_encap_setup() recomputes tunnel->hlen without the ERSPAN part.
dev->needed_headroom is not refreshed either, since ip_tunnel_update()
only rebinds when the link or the fwmark changes.
erspan_xmit() then pushes an ERSPAN header sized from the new
tunnel->erspan_ver, while __gre_xmit() lays the GRE header out from the
stale tunnel->tun_hlen. After a version 0 -> 2 change, tun_hlen is still
4 and gre_build_header() writes the sequence number at
greh + tun_hlen - 4, that is over greh->flags and greh->protocol. The
MTU keeps the value derived from the old header length.
There is no memory safety issue: dev->needed_headroom is at least
tunnel->hlen + sizeof(struct iphdr), and erspan_xmit() pushes at most
12 + 8 bytes before ip_tunnel_xmit() takes over and cows again.
Move the computation into erspan_set_hlen() and add
erspan_link_update(), refreshing the lengths as the previous patch does
for plain GRE. Call erspan_set_hlen() before ip_tunnel_changelink() so
that ip_tunnel_update() sees the updated tunnel->hlen and erspan_xmit()
sees a matching tun_hlen, and run erspan_link_update() at the end of
erspan_changelink(), including on error paths, as ipgre_changelink()
does.
Fixes: f551c91de262 ("net: erspan: introduce erspan v2 for ip_gre")
Cc: stable@vger.kernel.org
Signed-off-by: Eric Dumazet <edumazet@google.com>
---
net/ipv4/ip_gre.c | 57 +++++++++++++++++++++++++++++++++++++++--------
1 file changed, 48 insertions(+), 9 deletions(-)
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index ced57cbeaad4991487e9ddb29fa18ae6a1f134fb..696884f53cdcc65fe87cf04f357f1cc45a7e0736 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c@@ -1379,18 +1379,43 @@ static const struct net_device_ops gre_tap_netdev_ops = { .ndo_fill_metadata_dst = gre_fill_metadata_dst, }; +static void erspan_set_hlen(struct ip_tunnel *tunnel) +{ + /* Version 0 uses a 4-byte GRE header, other versions use 8 bytes. */ + tunnel->tun_hlen = tunnel->erspan_ver == 0 ? 4 : 8; + + tunnel->hlen = tunnel->tun_hlen + tunnel->encap_hlen + + erspan_hdr_len(tunnel->erspan_ver); +} + +/* Both tunnel->erspan_ver and tunnel->encap_hlen can be changed from + * erspan_changelink(), and both feed tunnel->hlen. Recompute it, then let + * ip_tunnel_bind_dev() derive the device lengths from it. + * + * As in ipgre_link_update(), @old_hlen only tells whether the MTU became + * stale and must be sampled before ip_tunnel_encap_setup(), which + * recomputes tunnel->hlen without the ERSPAN part. + */ +static void erspan_link_update(struct net_device *dev, bool set_mtu, + int old_hlen) +{ + struct ip_tunnel *tunnel = netdev_priv(dev); + + erspan_set_hlen(tunnel); + + /* Only reset a MTU that the header length just invalidated, so that + * a MTU configured by the user survives an unrelated change. + */ + ip_tunnel_refresh_lengths(dev, set_mtu && tunnel->hlen != old_hlen); +} + static int erspan_tunnel_init(struct net_device *dev) { struct ip_tunnel *tunnel = netdev_priv(dev); - if (tunnel->erspan_ver == 0) - tunnel->tun_hlen = 4; /* 4-byte GRE hdr. */ - else - tunnel->tun_hlen = 8; /* 8-byte GRE hdr. */ + erspan_set_hlen(tunnel); tunnel->parms.iph.protocol = IPPROTO_GRE; - tunnel->hlen = tunnel->tun_hlen + tunnel->encap_hlen + - erspan_hdr_len(tunnel->erspan_ver); dev->features |= GRE_FEATURES; dev->hw_features |= GRE_FEATURES;
@@ -1529,6 +1554,7 @@ static int erspan_changelink(struct net_device *dev, struct nlattr *tb[], struct ip_tunnel *t = netdev_priv(dev); struct ip_tunnel_parm_kern p; __u32 fwmark = t->fwmark; + int old_hlen = t->hlen; int err; if (!rtnl_dev_link_net_capable(dev, t->net))
@@ -1540,16 +1566,29 @@ static int erspan_changelink(struct net_device *dev, struct nlattr *tb[], err = erspan_netlink_parms(dev, data, tb, &p, &fwmark); if (err < 0) - return err; + goto link_update; + + erspan_set_hlen(t); err = ip_tunnel_changelink(dev, tb, &p, fwmark); if (err < 0) - return err; + goto link_update; ip_tunnel_flags_copy(t->parms.i_flags, p.i_flags); ip_tunnel_flags_copy(t->parms.o_flags, p.o_flags); - return 0; +link_update: + /* ipgre_newlink_encap_setup() has published a new encapsulation, and + * erspan_netlink_parms() a new ERSPAN version, both of which change + * the header length. Refresh the lengths on the error paths as well, + * since both leave the new encapsulation or version behind. + * + * As in ipgre_changelink(), IFLA_MTU must not hold the MTU back if we + * return an error, because do_setlink() will not apply it then. + */ + erspan_link_update(dev, err || !tb[IFLA_MTU], old_hlen); + + return err; } static size_t ipgre_get_size(const struct net_device *dev)
--
2.55.0.1032.g73a4cd73de-goog