With IPv6 enabled, sk_saddr_any() checks sk_v6_rcv_saddr also for AF_INET sockets, where it is always zero. An IPv4 tunnel socket bound to a specific address (e.g. fou or geneve with "local") ends up in the GRO lookup fast path, although another socket may bind the same port on a different address: GRO then hands that socket's packets to the tunnel's gro_receive. Check the IPv6 address only for AF_INET6 sockets. Fixes: a36283e2b683 ("udp_tunnel: create a fastpath GRO lookup.") Signed-off-by: Antonio Quartulli --- net/ipv4/udp_tunnel_core.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/net/ipv4/udp_tunnel_core.c b/net/ipv4/udp_tunnel_core.c index a128fe85620d..29581c94fdcf 100644 --- a/net/ipv4/udp_tunnel_core.c +++ b/net/ipv4/udp_tunnel_core.c @@ -62,10 +62,10 @@ EXPORT_SYMBOL(udp_sock_create4); static bool sk_saddr_any(struct sock *sk) { #if IS_ENABLED(CONFIG_IPV6) - return ipv6_addr_any(&sk->sk_v6_rcv_saddr); -#else - return !sk->sk_rcv_saddr; + if (sk->sk_family == AF_INET6) + return ipv6_addr_any(&sk->sk_v6_rcv_saddr); #endif + return !sk->sk_rcv_saddr; } void setup_udp_tunnel_sock(struct net *net, struct sock *sk, -- 2.56.0