netdev - Re: [PATCH net] ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <DG4WS03VX6EY.2J61SWXW7AIAR@garyguo.net>
Date: Tue, 03 Feb 2026 00:43:14 +0000
From: "Gary Guo" <gary@...yguo.net>
To: "Eric Dumazet" <edumazet@...gle.com>, "Hirokazu MORIKAWA"
 <morikw2@...il.com>
Cc: <davem@...emloft.net>, <eric.dumazet@...il.com>, <horms@...nel.org>,
 <kuba@...nel.org>, <netdev@...r.kernel.org>, <pabeni@...hat.com>,
 <syzbot+d4dda070f833dc5dc89a@...kaller.appspotmail.com>
Subject: Re: [PATCH net] ip6_tunnel: use skb_vlan_inet_prepare() in
 __ip6_tnl_rcv()

On Fri Jan 30, 2026 at 12:00 PM GMT, Eric Dumazet wrote:
> On Fri, Jan 30, 2026 at 5:15 AM Hirokazu MORIKAWA <morikw2@...il.com> wrote:
>>
>> [REGRESSION] ip6_tunnel: IPv4 traffic broken in MAP-E/DS-Lite since
>> commit df5ffde96693
>>
>> Hi,
>> I am reporting a regression in the IPv6 tunneling stack (MAP-E and
>> DS-Lite) introduced in kernel 6.12.67.
>>
>> [Description] After upgrading the kernel from 6.12.66 to 6.12.67 in
>> the OpenWrt snapshot, IPv4 packets can no longer be sent to the
>> external network via MAP-E or DS-Lite interfaces.
>> [Environment]
>> * Hardware: FriendlyElec NanoPi R6C
>> * OS: OpenWrt snapshot
>> * Kernel version: 6.12.67 (Broken), 6.12.66 (Working)
>> * Protocol: MAP-E and DS-Lite
>> [Culprit] By bisecting/reverting individual commits, I have identified
>> that the following commit is responsible for this issue:
>> "ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()" (Link to
>> the patch: https://lore.kernel.org/netdev/20260107163109.4188620-1-edumazet@google.com/)
>> Reverting this specific commit on top of kernel 6.12.67 restores
>> normal connectivity for both MAP-E and DS-Lite.
>> [Steps to reproduce]
>> 1. Set up a MAP-E or DS-Lite connection on kernel 6.12.67.
>> 2. Attempt to send IPv4 traffic (e.g., ping 8.8.8.8).
>> 3. The packets fail to reach the destination.
>
> Thanks for the report.
>
> Can you provide detailed instructions ?
>
> Apparently none of our selftests caught the issue, it would be great to add one.
>
> I have no idea what MAP-E or DS-Lite are.

Hi Eric,

I'm troubleshooting a regression on my system after 6.12.63 -> 6.12.67 upgrade
and my bisecting point to this patch too.

My setup is a IP6GRE tunnel over WireGuard, and after the upgrade it can no
longer receive any packets over the GRE tunnel. Using tcpdump I can see packets
coming in from WireGuard, but they don't end up in the GRE interface. Reverting
this change, everything works again.

I am not a kernel netdev expert, but to me it looks like skb_vlan_inet_prepare
ignores the network_header on the packet completely, which is going to be non
zero if skb->data != skb->head, given before calling the function,
skb_reset_network_header is invoked. And in my case where there is an outer
encapsulation layer, skb->data != skb->head would actually happen.

Best,
Gary