Re: [PATCH] udp_tunnel: avoid calling the wrong GRO handler

[Paolo Abeni]

On 9/6/26 11:13 PM, Jérémy Jean wrote:
> setup_udp_tunnel_sock() installs the GRO handlers before updating the
> global static call. The socket is already bound, so packets can arrive
> while the static call still points to the handler for another tunnel
> type. Receive and completion can then parse the packet differently,
> leading to OOB write.

Interesting. A stack trace would be useful. As pointed out by sashiko
the issue is very likely reachable even without the static call.

I wild guess sort of full GRO flush is required before installing or
removing a tunnel, regardless the static call infra.
> Removing the static call is enough since the existing fallback already
> calls the handler selected during setup through call_gro_receive_sk().
> The helper also performs the same recursion check and sets the flush
> flag when the limit is reached.
> 
> Fixes: 5d7f5b2f6b93 ("udp_tunnel: use static call for GRO hooks when possible")
> Assisted-by: Codex:gpt-6

Even this one is interesting; this patch left out things that I supposed
much older model should catch easily.

Also please see commit 816d9992d9ed434ec52cfbd63080d518e535a41b

/P