Hi all,
__vlan_tunnel_info_add() accepts tunnel ID 0, creates a valid
tunnel_dst, and inserts the VLAN into the tunnel hash with key 0.
Ingress looks up key 0 and retags the frame.
The egress path treats tunnel_id == 0 as "not configured" and returns
before installing tunnel metadata. The same mapping therefore works in
one direction and is inert in the other, while RTM_GETLINK reports it
as present.
Observed on Linux v7.3, commit
08ab31164c55f20c7a2653de3186ae333470e2c1:
VID 100 -> tunnel id 0:
ingress VNI 0 is retagged to VID 100
egress emits VID 100 tagged but installs no VXLAN metadata
remap VID 100 -> tunnel id 3000:
egress immediately produces VNI 3000
Two independent cold boots produced the same result.
Either reject tunnel ID 0 as reserved or stop using zero as the egress
presence sentinel and make ingress and egress interpret the mapping
consistently.
This is distinct from candidate BR-063's netlink-size undercount for a
tid-zero entry, which has a pending sizing patch.
I found no matching functional fix or CVE.
The self-contained PoC and both console logs are available on request.
This was found with a multi-agent workflow; the
ingress/egress asymmetry was reproduced in QEMU.
Thanks,
Cheng Yongkang
