Re: [PATCH net v2] vxlan: use one headroom snapshot for neighbour replies

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@xxxxxxxxxx>:

On Fri, 18 Sep 2026 12:26:58 +0900 you wrote:
> vxlan_na_create() samples LL_RESERVED_SPACE() to size the reply skb and then
> samples it again to reserve headroom. A concurrent vxlan_changelink() can
> update needed_headroom between the two reads, creating a TOCTOU race. The
> second value can exceed the allocation and make the Ethernet header write out
> of bounds.
> 
> The race is reproducible on the unpatched kernel. It occurred when
> vxlan_na_create() generated a neighbour reply while vxlan_changelink() changed
> the link headroom. KASAN caught a four-byte write two bytes beyond a 704-byte
> skbuff_small_head allocation.
> 
> [...]

Here is the summary with links:
  - [net,v2] vxlan: use one headroom snapshot for neighbour replies
    https://git.kernel.org/netdev/net/c/481506a756dc

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html