kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-10 20:48:12 +00:00
Code Issues Releases Packages Activity
linux/drivers/net/vxlan
History
Sanghyun Park 481506a756 vxlan: use one headroom snapshot for neighbour replies 
vxlan_na_create() samples LL_RESERVED_SPACE() to size the reply skb and then
samples it again to reserve headroom. A concurrent vxlan_changelink() can
update needed_headroom between the two reads, creating a TOCTOU race. The
second value can exceed the allocation and make the Ethernet header write out
of bounds.

The race is reproducible on the unpatched kernel. It occurred when
vxlan_na_create() generated a neighbour reply while vxlan_changelink() changed
the link headroom. KASAN caught a four-byte write two bytes beyond a 704-byte
skbuff_small_head allocation.

Snapshot the headroom once and use that value for both allocation and
reservation.

Fixes: 4b29dba9c0 ("vxlan: fix nonfunctional neigh_reduce()")
Signed-off-by: Sanghyun Park <sanghyun.park.cnu@gmail.com>
Link: https://patch.msgid.link/20260918032842.502409-2-sanghyun.park.cnu@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
History 2026-09-23 19:29:26 -07:00
..
Makefile vxlan: mdb: Add MDB control path support 2023-03-17 08:05:49 +00:00
vxlan_core.c vxlan: use one headroom snapshot for neighbour replies 2026-09-23 19:29:26 -07:00
vxlan_mdb.c vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del() 2026-08-30 14:19:59 -07:00
vxlan_multicast.c vxlan: Store struct sock in struct vxlan_sock. 2026-05-05 17:47:04 -07:00
vxlan_private.h vxlan: Remove unused declarations eth_vni_hash() and fdb_head_index() 2025-11-13 17:20:54 -08:00
vxlan_vnifilter.c vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes 2026-08-17 15:57:07 -07:00