Re: [PATCH net] ip6_gre: validate ERSPAN skb dst before PMTU update

On Wed, Sep 30, 2026 at 9:53 AM Daehyeon Ko [off-list ref] wrote:

A tc tunnel_key action can attach a METADATA_IP_TUNNEL dst to an skb,
and mirred preserves it when redirecting the skb to a native ip6erspan
device. ip6erspan_tunnel_xmit() treats any non-NULL dst as a route for
PMTU updates. A metadata dst has no output device, so
dst_dev(dst)->mtu dereferences NULL.

On v7.2 with KASAN, an initial UID/GID 65534 process with CapEff 0
created user and network namespaces, used namespace-local CAP_NET_ADMIN,
and triggered:

  KASAN: null-ptr-deref
  RIP: 0010:ip6erspan_tunnel_xmit+0x10fc/0x2cc0
  Kernel panic - not syncing: Fatal exception in interrupt

The collect-metadata path already skips this block because its metadata
describes the outer tunnel. Native mode must still propagate PMTU updates
for real route destinations. Use skb_valid_dst(), matching IPv4 tunnel
PMTU handling, to exclude DST_METADATA without suppressing valid routes.

With this change, the same trigger processed three packets without a
sanitizer report, oops, or panic.

Fixes: 5a963eb61b7c ("ip6_gre: Add ERSPAN native tunnel support")
Cc: stable@vger.kernel.org
Assisted-by: Codex:GPT-5
Signed-off-by: Daehyeon Ko <redacted>

SGTM, thanks.

Reviewed-by: Eric Dumazet <edumazet@kernel.org>