netdev - Re: [PATCH net] net: vxlan: prevent NULL deref in vxlan_xmit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <emskewx4qfgxdhp6tvfx5fgz2nkcuv6sln6cde7m5jqm2rybmj@odtf6g5zu2no>
Date: Tue, 25 Nov 2025 09:26:14 +0100
From: Antoine Tenart <atenart@...nel.org>
To: Jakub Kicinski <kuba@...nel.org>
Cc: davem@...emloft.net, pabeni@...hat.com, edumazet@...gle.com, 
	andrew+netdev@...n.ch, netdev@...r.kernel.org, Liang Li <liali@...hat.com>, 
	Beniamino Galvani <b.galvani@...il.com>
Subject: Re: [PATCH net] net: vxlan: prevent NULL deref in vxlan_xmit_one

On Mon, Nov 24, 2025 at 07:51:19PM -0800, Jakub Kicinski wrote:
> On Mon, 24 Nov 2025 17:30:59 +0100 Antoine Tenart wrote:
> > Neither sock4 nor sock6 pointers are guaranteed to be non-NULL in
> > vxlan_xmit_one, e.g. if the iface is brought down. This can lead to the
> > following NULL dereference:
> > 
> >   BUG: kernel NULL pointer dereference, address: 0000000000000010
> >   Oops: Oops: 0000 [#1] SMP NOPTI
> >   RIP: 0010:vxlan_xmit_one+0xbb3/0x1580
> >   Call Trace:
> >    vxlan_xmit+0x429/0x610
> >    dev_hard_start_xmit+0x55/0xa0
> >    __dev_queue_xmit+0x6d0/0x7f0
> >    ip_finish_output2+0x24b/0x590
> >    ip_output+0x63/0x110
> > 
> > Mentioned commits changed the code path in vxlan_xmit_one and as a side
> > effect the sock4/6 pointer validity checks in vxlan(6)_get_route were
> > lost. Fix this by adding back checks.
> > 
> > Since both commits being fixed were released in the same version (v6.7)
> > and are strongly related, bundle the fixes in a single commit.
> > 
> > Reported-by: Liang Li <liali@...hat.com>
> > Fixes: 6f19b2c136d9 ("vxlan: use generic function for tunnel IPv4 route lookup")
> > Fixes: 2aceb896ee18 ("vxlan: use generic function for tunnel IPv6 route lookup")
> > Cc: Beniamino Galvani <b.galvani@...il.com>
> > Signed-off-by: Antoine Tenart <atenart@...nel.org>
> 
> clang sayeth:
> 
> ../drivers/net/vxlan/vxlan_core.c:2548:7: warning: variable 'err' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized]
>  2548 |                 if (unlikely(!sock6)) {
>       |                     ^~~~~~~~~~~~~~~~
> ../include/linux/compiler.h:77:22: note: expanded from macro 'unlikely'
>    77 | # define unlikely(x)    __builtin_expect(!!(x), 0)
>       |                         ^~~~~~~~~~~~~~~~~~~~~~~~~~
> ../drivers/net/vxlan/vxlan_core.c:2631:6: note: uninitialized use occurs here
>  2631 |         if (err == -ELOOP)
>       |             ^~~
> ../drivers/net/vxlan/vxlan_core.c:2548:3: note: remove the 'if' if its condition is always false
>  2548 |                 if (unlikely(!sock6)) {
>       |                 ^~~~~~~~~~~~~~~~~~~~~~~
>  2549 |                         reason = SKB_DROP_REASON_DEV_READY;
>       |                         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>  2550 |                         goto tx_error;
>       |                         ~~~~~~~~~~~~~~
>  2551 |                 }
>       |                 ~
> ../drivers/net/vxlan/vxlan_core.c:2464:7: warning: variable 'err' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized]
>  2464 |                 if (unlikely(!sock4)) {
>       |                     ^~~~~~~~~~~~~~~~
> ../include/linux/compiler.h:77:22: note: expanded from macro 'unlikely'
>    77 | # define unlikely(x)    __builtin_expect(!!(x), 0)
>       |                         ^~~~~~~~~~~~~~~~~~~~~~~~~~
> ../drivers/net/vxlan/vxlan_core.c:2631:6: note: uninitialized use occurs here
>  2631 |         if (err == -ELOOP)
>       |             ^~~
> ../drivers/net/vxlan/vxlan_core.c:2464:3: note: remove the 'if' if its condition is always false
>  2464 |                 if (unlikely(!sock4)) {
>       |                 ^~~~~~~~~~~~~~~~~~~~~~~
>  2465 |                         reason = SKB_DROP_REASON_DEV_READY;
>       |                         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>  2466 |                         goto tx_error;
>       |                         ~~~~~~~~~~~~~~
>  2467 |                 }
>       |                 ~
> ../drivers/net/vxlan/vxlan_core.c:2352:9: note: initialize the variable 'err' to silence this warning
>  2352 |         int err;
>       |                ^
>       |                 = 0

I missed that somehow... will fix in v2. Thanks!