Sanghyun Park 481506a756 vxlan: use one headroom snapshot for neighbour replies ... vxlan_na_create() samples LL_RESERVED_SPACE() to size the reply skb and then samples it again to reserve headroom. A concurrent vxlan_changelink() can update needed_headroom between the two reads, creating a TOCTOU race. The second value can exceed the allocation and make the Ethernet header write out of bounds. The race is reproducible on the unpatched kernel. It occurred when vxlan_na_create() generated a neighbour reply while vxlan_changelink() changed the link headroom. KASAN caught a four-byte write two bytes beyond a 704-byte skbuff_small_head allocation. Snapshot the headroom once and use that value for both allocation and reservation. Fixes: 4b29dba9c0 ("vxlan: fix nonfunctional neigh_reduce()") Signed-off-by: Sanghyun Park <sanghyun.park.cnu@gmail.com> Link: https://patch.msgid.link/20260918032842.502409-2-sanghyun.park.cnu@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2026-09-23 19:29:26 -07:00
..
Makefile	vxlan: mdb: Add MDB control path support	2023-03-17 08:05:49 +00:00
vxlan_core.c	vxlan: use one headroom snapshot for neighbour replies	2026-09-23 19:29:26 -07:00
vxlan_mdb.c	vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del()	2026-08-30 14:19:59 -07:00
vxlan_multicast.c	vxlan: Store struct sock in struct vxlan_sock.	2026-05-05 17:47:04 -07:00
vxlan_private.h	vxlan: Remove unused declarations eth_vni_hash() and fdb_head_index()	2025-11-13 17:20:54 -08:00
vxlan_vnifilter.c	vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes	2026-08-17 15:57:07 -07:00