Commit 3fcece12bc1b6 ("net: store port/representator id in metadata_dst") dropped the options_len equality check when converting skb_metadata_dst_cmp() to a type switch, so the memcmp length is taken from skb a alone. When skb b carries fewer options than a, the comparison reads past b's allocation. Hit in practice with Cilium geneve GRO aggregation, comparing an skb carrying 12 bytes of tunnel options against one carrying none: memcmp: detected buffer overflow: 108 byte read of buffer size 96 WARNING: CPU: 0 PID: 15 at lib/string_helpers.c:1036 __fortify_report __fortify_panic+0x9/0x10 skb_metadata_dst_cmp+0x11b/0x120 dev_gro_receive+0x303/0x620 gro_cell_poll+0x67/0xa0 Restore the check: unequal options_len means different metadata and no aggregation; the memcmp only runs when both sides carry the same options length. Fixes: 3fcece12bc1b6 ("net: store port/representator id in metadata_dst") Cc: stable@vger.kernel.org Cc: Ilya Maximets Cc: Sasha Levin Cc: Jakub Kicinski Cc: "David S. Miller" Cc: Eric Dumazet Cc: Paolo Abeni Cc: Simon Horman Cc: Sridhar Samudrala Cc: Kees Cook Signed-off-by: Jean-Paul Sergent --- v3: - Restore options_len equality check as a one-liner; drop two-stage compare entirely (Ilya Maximets). - Update Fixes: tag to 3fcece12bc1b instead of 69050f8d6d07 (Ilya Maximets, Sasha Levin). - Add author Signed-off-by, drop Reported-by (Ilya Maximets). - Drop redundant Closes: tag (Ilya Maximets). - Add maintainer Cc list via get_maintainer.pl (Ilya Maximets). - Remove superfluous in-code comments and trim commit log (Ilya Maximets). v2: https://lore.kernel.org/netdev/20261003005449.2675.3@jpsergent.gmail.com/ - Fix subject prefix to [PATCH net]; no code changes. v1: https://lore.kernel.org/netdev/20261003005449.2675.2@jpsergent.gmail.com/ include/net/dst_metadata.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/include/net/dst_metadata.h b/include/net/dst_metadata.h index f45d1e3163f0..02fffbb85099 100644 --- a/include/net/dst_metadata.h +++ b/include/net/dst_metadata.h @@ -116,6 +116,8 @@ static inline int skb_metadata_dst_cmp(const struct sk_buff *skb_a, return memcmp(&a->u.port_info, &b->u.port_info, sizeof(a->u.port_info)); case METADATA_IP_TUNNEL: + if (a->u.tun_info.options_len != b->u.tun_info.options_len) + return 1; return memcmp(&a->u.tun_info, &b->u.tun_info, sizeof(a->u.tun_info) + a->u.tun_info.options_len); -- 2.56.0