netdev - Re: [PATCH net] net: vxlan: prevent NULL deref in vxlan_xmit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251124195119.0199d58a@kernel.org>
Date: Mon, 24 Nov 2025 19:51:19 -0800
From: Jakub Kicinski <kuba@...nel.org>
To: Antoine Tenart <atenart@...nel.org>
Cc: davem@...emloft.net, pabeni@...hat.com, edumazet@...gle.com,
 andrew+netdev@...n.ch, netdev@...r.kernel.org, Liang Li <liali@...hat.com>,
 Beniamino Galvani <b.galvani@...il.com>
Subject: Re: [PATCH net] net: vxlan: prevent NULL deref in vxlan_xmit_one

On Mon, 24 Nov 2025 17:30:59 +0100 Antoine Tenart wrote:
> Neither sock4 nor sock6 pointers are guaranteed to be non-NULL in
> vxlan_xmit_one, e.g. if the iface is brought down. This can lead to the
> following NULL dereference:
> 
>   BUG: kernel NULL pointer dereference, address: 0000000000000010
>   Oops: Oops: 0000 [#1] SMP NOPTI
>   RIP: 0010:vxlan_xmit_one+0xbb3/0x1580
>   Call Trace:
>    vxlan_xmit+0x429/0x610
>    dev_hard_start_xmit+0x55/0xa0
>    __dev_queue_xmit+0x6d0/0x7f0
>    ip_finish_output2+0x24b/0x590
>    ip_output+0x63/0x110
> 
> Mentioned commits changed the code path in vxlan_xmit_one and as a side
> effect the sock4/6 pointer validity checks in vxlan(6)_get_route were
> lost. Fix this by adding back checks.
> 
> Since both commits being fixed were released in the same version (v6.7)
> and are strongly related, bundle the fixes in a single commit.
> 
> Reported-by: Liang Li <liali@...hat.com>
> Fixes: 6f19b2c136d9 ("vxlan: use generic function for tunnel IPv4 route lookup")
> Fixes: 2aceb896ee18 ("vxlan: use generic function for tunnel IPv6 route lookup")
> Cc: Beniamino Galvani <b.galvani@...il.com>
> Signed-off-by: Antoine Tenart <atenart@...nel.org>

clang sayeth:

../drivers/net/vxlan/vxlan_core.c:2548:7: warning: variable 'err' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized]
 2548 |                 if (unlikely(!sock6)) {
      |                     ^~~~~~~~~~~~~~~~
../include/linux/compiler.h:77:22: note: expanded from macro 'unlikely'
   77 | # define unlikely(x)    __builtin_expect(!!(x), 0)
      |                         ^~~~~~~~~~~~~~~~~~~~~~~~~~
../drivers/net/vxlan/vxlan_core.c:2631:6: note: uninitialized use occurs here
 2631 |         if (err == -ELOOP)
      |             ^~~
../drivers/net/vxlan/vxlan_core.c:2548:3: note: remove the 'if' if its condition is always false
 2548 |                 if (unlikely(!sock6)) {
      |                 ^~~~~~~~~~~~~~~~~~~~~~~
 2549 |                         reason = SKB_DROP_REASON_DEV_READY;
      |                         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 2550 |                         goto tx_error;
      |                         ~~~~~~~~~~~~~~
 2551 |                 }
      |                 ~
../drivers/net/vxlan/vxlan_core.c:2464:7: warning: variable 'err' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized]
 2464 |                 if (unlikely(!sock4)) {
      |                     ^~~~~~~~~~~~~~~~
../include/linux/compiler.h:77:22: note: expanded from macro 'unlikely'
   77 | # define unlikely(x)    __builtin_expect(!!(x), 0)
      |                         ^~~~~~~~~~~~~~~~~~~~~~~~~~
../drivers/net/vxlan/vxlan_core.c:2631:6: note: uninitialized use occurs here
 2631 |         if (err == -ELOOP)
      |             ^~~
../drivers/net/vxlan/vxlan_core.c:2464:3: note: remove the 'if' if its condition is always false
 2464 |                 if (unlikely(!sock4)) {
      |                 ^~~~~~~~~~~~~~~~~~~~~~~
 2465 |                         reason = SKB_DROP_REASON_DEV_READY;
      |                         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 2466 |                         goto tx_error;
      |                         ~~~~~~~~~~~~~~
 2467 |                 }
      |                 ~
../drivers/net/vxlan/vxlan_core.c:2352:9: note: initialize the variable 'err' to silence this warning
 2352 |         int err;
      |                ^
      |                 = 0
-- 
pw-bot: cr