Re: [PATCH net-next 1/2] erspan: drop packets with an unknown ERSPAN version

[Ido Schimmel]

On Sun, Oct 18, 2026 at 05:02:35PM +0800, Haishuang Yan wrote:
> The ERSPAN type II and III receive paths take the length of the ERSPAN
> header from the version field of the packet, with erspan_hdr_len(), but
> never check that the version is one they know: 1 for type II or 2 for
> type III.
> 
> For any other version, erspan_hdr_len() returns 0 or the type III
> length. With version 0, the ERSPAN header is not pulled at all, so it
> is passed up as the start of the inner Ethernet frame, and in collect_md
> mode the metadata is copied from 8 bytes after the base header, which
> pskb_may_pull() did not cover.

__iptunnel_pull_header() drops the packet if it can't pull the Ethernet
header of the encapsulated packet, so there's no memory safety issue
here. Only reading metadata from the wrong place.

> 
> Reject such packets, as a packet with a truncated ERSPAN header already
> is.
> 
> Fixes: f551c91de262 ("net: erspan: introduce erspan v2 for ip_gre")
> Fixes: 94d7d8f29287 ("ip6_gre: add erspan v2 support")

Given that this never worked and that there's no security issue here,
drop these tags and target v2 at net-next when it re-opens.

> 
> Signed-off-by: Haishuang Yan <yanhaishuang@xxxxxxxxxxxxxxxxxxxx>