memcmp: detected buffer overflow: 108 byte read of buffer size 96 WARNING: CPU: 0 PID: 15 at lib/string_helpers.c:1036 __fortify_report+0x45/0x60 __fortify_panic+0x9/0x10 skb_metadata_dst_cmp+0x11b/0x120 dev_gro_receive+0x303/0x620 gro_receive_skb+0xc5/0x230 gro_cell_poll+0x67/0xa0 Same disease as the tun_dst_unclone fix (4c6d43db2a4d), on the RX sibling: kmalloc_flex() in metadata_dst_alloc() sets __counted_by for the structure to options_len, which is then initialized to zero, so the compiler's view of the metadata_dst tail is 96 bytes at the time of the access. Geneve carries 108 bytes of options, and the combined struct+options memcmp trips CONFIG_FORTIFY_SOURCE when built with clang. Observed live on 6.18.54-talos with Cilium geneve, in gro_cell_poll (gro_cells GRO on the geneve device) under sustained cross-node RX; the warning is followed by a fatal Oops (kernel BUG at lib/string_helpers.c:1043). While here, fix a related overread: the memcmp length uses a->u.tun_info.options_len for BOTH sides, so when b carries fewer options than a the comparison reads past b's allocation. Pre-check that both sides carry the same options_len and compare the options through ip_tunnel_info_opts() so the counted_by view matches the read length (the same two-stage shape the unclone fix uses). Fixes: 69050f8d6d07 ("treewide: Replace kmalloc with kmalloc_obj for non-scalar types") Cc: stable@vger.kernel.org Reported-by: Jean-Paul Sergent Closes: https://lore.kernel.org/netdev/20261003005449.2675.1@jpsergent.gmail.com/ Assisted-by: LLM --- Reproduced without the fix: live kernel panic on 6.18.54-talos (Cilium geneve, gro_cell_poll) under sustained cross-node RX; trace in the report. The fix itself is NOT build-tested - no kernel build environment on the reporter's host. --- include/net/dst_metadata.h | 28 ++++++++++++++++++++++++---- 1 file changed, 24 insertions(+), 4 deletions(-) diff --git a/include/net/dst_metadata.h b/include/net/dst_metadata.h index f45d1e3..60878ea 100644 --- a/include/net/dst_metadata.h +++ b/include/net/dst_metadata.h @@ -115,10 +115,30 @@ static inline int skb_metadata_dst_cmp(const struct sk_buff *skb_a, case METADATA_HW_PORT_MUX: return memcmp(&a->u.port_info, &b->u.port_info, sizeof(a->u.port_info)); - case METADATA_IP_TUNNEL: - return memcmp(&a->u.tun_info, &b->u.tun_info, - sizeof(a->u.tun_info) + - a->u.tun_info.options_len); + case METADATA_IP_TUNNEL: { + int ret; + + /* Options lengths must match, or the options memcmp below + * would read past b's allocation when b carries fewer + * options than a. + */ + if (a->u.tun_info.options_len != b->u.tun_info.options_len) + return 1; + ret = memcmp(&a->u.tun_info, &b->u.tun_info, + sizeof(a->u.tun_info)); + if (ret) + return ret; + /* Compare the options through the flex-array member so the + * compiler's __counted_by(options_len) view stays consistent + * with the read length (same shape as the tun_dst_unclone + * fix); a single memcmp of struct+options trips + * CONFIG_FORTIFY_SOURCE when options_len is still 0 from + * allocation time. + */ + return memcmp(ip_tunnel_info_opts(&a->u.tun_info), + ip_tunnel_info_opts(&b->u.tun_info), + a->u.tun_info.options_len); + } case METADATA_MACSEC: return memcmp(&a->u.macsec_info, &b->u.macsec_info, sizeof(a->u.macsec_info)); -- 2.55.0