Re: [PATCH net v2] vxlan: use one headroom snapshot for neighbour replies

[Hangbin Liu <hangbin.liu@linux.dev>]

Hi Sanghyun,
On Fri, Sep 18, 2026 at 12:26:58PM +0900, Sanghyun Park wrote:
> vxlan_na_create() samples LL_RESERVED_SPACE() to size the reply skb and then
> samples it again to reserve headroom. A concurrent vxlan_changelink() can
> update needed_headroom between the two reads, creating a TOCTOU race. The
> second value can exceed the allocation and make the Ethernet header write out
> of bounds.
> 
> The race is reproducible on the unpatched kernel. It occurred when
> vxlan_na_create() generated a neighbour reply while vxlan_changelink() changed
> the link headroom. KASAN caught a four-byte write two bytes beyond a 704-byte
> skbuff_small_head allocation.
> 
> Snapshot the headroom once and use that value for both allocation and
> reservation.

What if `vxlan_changelink()` extends the link headroom and we need a much
larger headroom, yet we only allocate a small skb from snapshot?

Thanks
Hangbin

> 
> Fixes: 4b29dba9c085 ("vxlan: fix nonfunctional neigh_reduce()")
> Signed-off-by: Sanghyun Park <sanghyun.park.cnu@gmail.com>
> ---
> v2:
>   - Improve the v1 changelog
> v1: https://lore.kernel.org/r/20260831054614.2069896-2-sanghyun.park.cnu@gmail.com
> 
>  drivers/net/vxlan/vxlan_core.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c
> index c1d54339fa2b..3390e341d1e5 100644
> --- a/drivers/net/vxlan/vxlan_core.c
> +++ b/drivers/net/vxlan/vxlan_core.c
> @@ -1958,13 +1958,15 @@ static struct sk_buff *vxlan_na_create(struct sk_buff *request,
>  	struct ipv6hdr *pip6;
>  	u8 *daddr;
>  	int na_olen = 8; /* opt hdr + ETH_ALEN for target */
> +	int headroom;
>  	int ns_olen;
>  	int i, len;
>  
>  	if (dev == NULL || !pskb_may_pull(request, request->len))
>  		return NULL;
>  
> -	len = LL_RESERVED_SPACE(dev) + sizeof(struct ipv6hdr) +
> +	headroom = LL_RESERVED_SPACE(dev);
> +	len = headroom + sizeof(struct ipv6hdr) +
>  		sizeof(*na) + na_olen + dev->needed_tailroom;
>  	reply = alloc_skb(len, GFP_ATOMIC);
>  	if (reply == NULL)
> @@ -1972,7 +1974,7 @@ static struct sk_buff *vxlan_na_create(struct sk_buff *request,
>  
>  	reply->protocol = htons(ETH_P_IPV6);
>  	reply->dev = dev;
> -	skb_reserve(reply, LL_RESERVED_SPACE(request->dev));
> +	skb_reserve(reply, headroom);
>  	skb_push(reply, sizeof(struct ethhdr));
>  	skb_reset_mac_header(reply);
>  
> -- 
> 2.48.1