The ipip fill_forward_path callback currently does not check for configurations that cannot be offloaded to hardware: - Collect metadata (flow-based) tunnels have no fixed destination and rely on per-packet tunnel metadata, so the forward path cannot be pre-computed. - TOS inheritance (parms.iph.tos & 0x1) requires copying the outer TOS from the inner packet at encapsulation time, which is not known during forward path resolution. Return -EOPNOTSUPP for both cases to fall back to the software forwarding path. Signed-off-by: Lorenzo Bianconi --- net/ipv4/ipip.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c index d1aa048a6099..0831f6b81717 100644 --- a/net/ipv4/ipip.c +++ b/net/ipv4/ipip.c @@ -360,6 +360,12 @@ static int ipip_fill_forward_path(struct net_device_path_ctx *ctx, const struct iphdr *tiph = &tunnel->parms.iph; struct rtable *rt; + if (tunnel->collect_md) + return -EOPNOTSUPP; + + if (tunnel->parms.iph.tos & 0x1) + return -EOPNOTSUPP; + rt = ip_route_output(dev_net(ctx->dev), tiph->daddr, tiph->saddr, inet_dsfield_to_dscp(tiph->tos), tunnel->parms.link, RT_SCOPE_UNIVERSE); --- base-commit: 04026c998c24ac47eb76886b9790c5710b603eb4 change-id: 20260725-ipip-fill-forward-path-fix-543c41000a57 Best regards, -- Lorenzo Bianconi