)]}'
{
  "commit": "455ebeadf714f51e1dbbd6a022c74c9215b1cd76",
  "tree": "cb775d963a4823472e940bce94ae8b8f01bfb63c",
  "parents": [
    "ecc7253683a3c55caa868ce0ee530fcb0044bd3c"
  ],
  "author": {
    "name": "Gris Ge",
    "email": "cnfourt@gmail.com",
    "time": "Sun Sep 13 17:08:50 2026 +0800"
  },
  "committer": {
    "name": "Jakub Kicinski",
    "email": "kuba@kernel.org",
    "time": "Tue Sep 15 17:34:31 2026 -0700"
  },
  "message": "net: ip_tunnel: initialize `options_len` before referencing options\n\nThe following command triggers a kernel panic:\n\n  ip link add d0 type dummy; ip link set d0 up\n  ip route add 10.30.0.0/16 \\\n    encap ip id 300 geneve_opts 4660:66:11223344 dev d0\n\n  memcpy: detected buffer overflow: 4 byte write of buffer size 0\n  kernel BUG at lib/string_helpers.c:1044!\n  ...\n  ip_tun_parse_opts.part.0.cold+0x10/0x10\n  ip_tun_build_state+0x116/0x2a0\n\nOn kernels built with GCC 15+ and `CONFIG_FORTIFY_SOURCE`, the fortified\n`memcpy()` got 0 sized destination with request of 4 bytes length:\n\n  static int ip_tun_parse_opts_geneve(...)\n  {\n      ...\n      attr \u003d tb[LWTUNNEL_IP_OPT_GENEVE_DATA];\n      data_len \u003d nla_len(attr); /* \u003d\u003d 4 */\n\n      struct geneve_opt *opt \u003d ip_tunnel_info_opts(info) + opts_len;\n      memcpy(opt-\u003eopt_data, nla_data(attr), data_len);\n      /*     ^^^^^^^^^^^^^ 0 since options_len is assigned afterwards */\n\nFixed by initializing the counter before the options are referenced.\nMatching what `tunnel_key_opts_set()` already does.\n\nFixes: bb5e62f2d547 (\"net: Add options as a flexible array to struct ip_tunnel_info\")\nCc: stable@vger.kernel.org\nSigned-off-by: Gris Ge \u003ccnfourt@gmail.com\u003e\nReviewed-by: Hangbin Liu \u003cliuhangbin@kylinos.cn\u003e\nReviewed-by: Gustavo A. R. Silva \u003cgustavoars@kernel.org\u003e\nLink: https://patch.msgid.link/20260913090851.468216-1-cnfourt@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "5168d546ea2fdaf1f0927a17c27af9f706e9b6f9",
      "old_mode": 33188,
      "old_path": "net/ipv4/ip_tunnel_core.c",
      "new_id": "bab42b9e277f7a603090c105e9da793af1698541",
      "new_mode": 33188,
      "new_path": "net/ipv4/ip_tunnel_core.c"
    }
  ]
}