netdev - [PATCH net 0/3] vxlan: Fix NPDs when using nexthop objects

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250901065035.159644-1-idosch@nvidia.com>
Date: Mon, 1 Sep 2025 09:50:32 +0300
From: Ido Schimmel <idosch@...dia.com>
To: <netdev@...r.kernel.org>
CC: <davem@...emloft.net>, <kuba@...nel.org>, <pabeni@...hat.com>,
	<edumazet@...gle.com>, <andrew+netdev@...n.ch>, <horms@...nel.org>,
	<razor@...ckwall.org>, <petrm@...dia.com>, <mcremers@...udbear.nl>, "Ido
 Schimmel" <idosch@...dia.com>
Subject: [PATCH net 0/3] vxlan: Fix NPDs when using nexthop objects

With FDB nexthop groups, VXLAN FDB entries do not necessarily point to a
remote destination but rather to an FDB nexthop group. This means that
first_remote_{rcu,rtnl}() can return NULL and a few places in the driver
were not ready for that, resulting in NULL pointer dereferences.
Patches #1-#2 fix these NPDs.

Note that vxlan_fdb_find_uc() still dereferences the remote returned by
first_remote_rcu() without checking that it is not NULL, but this
function is only invoked by a single driver which vetoes the creation of
FDB nexthop groups. I will patch this in net-next to make the code less
fragile.

Patch #3 adds a selftests which exercises these code paths and tests
basic Tx functionality with FDB nexthop groups. I verified that the test
crashes the kernel without the first two patches.

Ido Schimmel (3):
  vxlan: Fix NPD when refreshing an FDB entry with a nexthop object
  vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects
  selftests: net: Add a selftest for VXLAN with FDB nexthop groups

 drivers/net/vxlan/vxlan_core.c               |  18 +-
 drivers/net/vxlan/vxlan_private.h            |   4 +-
 tools/testing/selftests/net/Makefile         |   1 +
 tools/testing/selftests/net/test_vxlan_nh.sh | 223 +++++++++++++++++++
 4 files changed, 237 insertions(+), 9 deletions(-)
 create mode 100755 tools/testing/selftests/net/test_vxlan_nh.sh

-- 
2.51.0