From: Jakub Kicinski Date: Mon, 27 Jul 2026 22:15:18 +0000 (-0700) Subject: Merge branch 'vxlan-fixes-for-skb-header-pulling-cloning-and-concurrency-in-tx-path' X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9c88929cc18cdc252aa8a57e9fa8cb441dc47642;p=thirdparty%2Fkernel%2Fstable.git Merge branch 'vxlan-fixes-for-skb-header-pulling-cloning-and-concurrency-in-tx-path' Eric Dumazet says: ==================== vxlan: fixes for skb header pulling, cloning, and concurrency in TX path While working on RTNL-less fill_info for vxlan, Sashiko found annoying pre-existing issues, adding noise to an already complex work. This series addresses some of them in VXLAN transmit path, primarily within route_shortcircuit(), header validation, and neighbour lookup. Patch 1 fixes a potential use-after-free in vxlan_xmit() caused by caching the Ethernet header pointer ('eth') before calling route_shortcircuit(), which can reallocate skb->head via pskb_may_pull(). Patch 2 calls skb_cow_head() in route_shortcircuit() before modifying the Ethernet header in-place, preventing packet header corruption when the skb is cloned (e.g., by packet sockets, tcpdump, or dev_queue_xmit). Patch 3 replaces direct reads of n->ha in route_shortcircuit() with neigh_ha_snapshot() to safely snapshot the neighbour hardware address under seqlock protection, avoiding potential torn reads during asynchronous updates. Patch 4 changes route_shortcircuit() to use pskb_network_may_pull() instead of pskb_may_pull(). Since skb->data points to the MAC header on transmit (skb_network_offset(skb) == ETH_HLEN), pskb_may_pull() was only checking 6 bytes into the IP header, leaving the remainder un-pulled in non-linear frags. Patch 5 applies pskb_network_may_pull() to the remaining transmit-path header pull checks in arp_reduce(), ND solicitation proxy checks, and MDB entry lookup, where skb->data similarly points to the Ethernet header. ==================== Link: https://patch.msgid.link/20260723144249.759100-1-edumazet@google.com Signed-off-by: Jakub Kicinski --- 9c88929cc18cdc252aa8a57e9fa8cb441dc47642