Re: [PATCH] fou: reject FOU_ENCAP_DIRECT with protocol 0 to prevent sk_buff leak

[Kuniyuki Iwashima]

On Sat, Sep 19, 2026 at 2:52 PM Hui Peng <benquike@xxxxxxxxx> wrote:
>
> In fou_udp_recv(), returning -fou->protocol to udp_queue_rcv_one_skb()
> triggers IP protocol resubmission when fou->protocol > 0, whereas returning
> 0 tells the UDP tunnel layer that the skb was consumed without freeing it.
> When a FOU_ENCAP_DIRECT socket is configured with FOU_ATTR_IPPROTO == 0,
> every received packet returns 0 from fou_udp_recv() and leaks the sk_buff.
>
> Reject FOU_ENCAP_DIRECT configurations with protocol 0 in parse_nl_config()
> and drop packets if !fou->protocol in fou_udp_recv().
>
> Fixes: 08d323234d10 ("net: fou: rename the source for linking")
> Assisted-by: LLM

Looks hallucinated ?

commit 7a9bc9e3f42391e4c187e099263cf7a1c4b69ff5
Author: Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>
Date:   Thu Jan 15 17:24:48 2026

    fou: Don't allow 0 for FOU_ATTR_IPPROTO.


> Signed-off-by: Hui Peng <benquike@xxxxxxxxx>
> ---
> diff --git a/net/ipv4/fou_core.c b/net/ipv4/fou_core.c
> index 5e867f1b5c1d..3fc087c808bc 100644
> --- a/net/ipv4/fou_core.c
> +++ b/net/ipv4/fou_core.c
> @@ -77,6 +77,9 @@ static int fou_udp_recv(struct sock *sk, struct sk_buff *skb)
>         if (!fou)
>                 return 1;
>
> +       if (unlikely(!fou->protocol))
> +               goto drop;
> +
>         if (fou_recv_pull(skb, fou, sizeof(struct udphdr)))
>                 goto drop;
>
> @@ -696,6 +699,9 @@ static int parse_nl_config(struct genl_info *info,
>         if (info->attrs[FOU_ATTR_TYPE])
>                 cfg->type = nla_get_u8(info->attrs[FOU_ATTR_TYPE]);
>
> +       if (cfg->type == FOU_ENCAP_DIRECT && !cfg->protocol)
> +               return -EINVAL;
> +
>         if (info->attrs[FOU_ATTR_REMCSUM_NOPARTIAL])
>                 cfg->flags |= FOU_F_REMCSUM_NOPARTIAL;
>