Re: [PATCH net] udp_tunnel: don't treat IPv4 sockets bound to an address as wildcard

[Kuniyuki Iwashima]

On Tue, 10 Nov 2026 12:33:06 +0100, Antonio Quartulli wrote:
> With IPv6 enabled, sk_saddr_any() checks sk_v6_rcv_saddr also for
> AF_INET sockets, where it is always zero. An IPv4 tunnel socket bound to
> a specific address (e.g. fou or geneve with "local") ends up in the GRO
> lookup fast path, although another socket may bind the same port on a
> different address: GRO then hands that socket's packets to the tunnel's
> gro_receive.
> 
> Check the IPv6 address only for AF_INET6 sockets.
> 
> Fixes: a36283e2b683 ("udp_tunnel: create a fastpath GRO lookup.")
> Signed-off-by: Antonio Quartulli <antonio@xxxxxxxxxxxxx>
> ---
>  net/ipv4/udp_tunnel_core.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/net/ipv4/udp_tunnel_core.c b/net/ipv4/udp_tunnel_core.c
> index a128fe85620d..29581c94fdcf 100644
> --- a/net/ipv4/udp_tunnel_core.c
> +++ b/net/ipv4/udp_tunnel_core.c
> @@ -62,10 +62,10 @@ EXPORT_SYMBOL(udp_sock_create4);
>  static bool sk_saddr_any(struct sock *sk)
>  {
>  #if IS_ENABLED(CONFIG_IPV6)
> -	return ipv6_addr_any(&sk->sk_v6_rcv_saddr);
> -#else
> -	return !sk->sk_rcv_saddr;
> +	if (sk->sk_family == AF_INET6)
> +		return ipv6_addr_any(&sk->sk_v6_rcv_saddr);
>  #endif
> +	return !sk->sk_rcv_saddr;

This is identical with inet_rcv_saddr_any().  As a follow-up
in net-next, please move sk_saddr_any() to include/net/sock.h
and use it everywhere.

Reviewed-by: Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>