vxlan_na_create() samples LL_RESERVED_SPACE() to size the reply skb and then
samples it again to reserve headroom. A concurrent vxlan_changelink() can
update needed_headroom between the two reads, creating a TOCTOU race. The
second value can exceed the allocation and make the Ethernet header write out
of bounds.

The race is reproducible on the unpatched kernel. It occurred when
vxlan_na_create() generated a neighbour reply while vxlan_changelink() changed
the link headroom. KASAN caught a four-byte write two bytes beyond a 704-byte
skbuff_small_head allocation.

Snapshot the headroom once and use that value for both allocation and
reservation.

Fixes: 4b29dba9c085 ("vxlan: fix nonfunctional neigh_reduce()")
Signed-off-by: Sanghyun Park <sanghyun.park.cnu@gmail.com>
---
v2:
  - Improve the v1 changelog
v1: https://lore.kernel.org/r/20260831054614.2069896-2-sanghyun.park.cnu@gmail.com

 drivers/net/vxlan/vxlan_core.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c
index c1d54339fa2b..3390e341d1e5 100644
--- a/drivers/net/vxlan/vxlan_core.c
+++ b/drivers/net/vxlan/vxlan_core.c
@@ -1958,13 +1958,15 @@ static struct sk_buff *vxlan_na_create(struct sk_buff *request,
 	struct ipv6hdr *pip6;
 	u8 *daddr;
 	int na_olen = 8; /* opt hdr + ETH_ALEN for target */
+	int headroom;
 	int ns_olen;
 	int i, len;
 
 	if (dev == NULL || !pskb_may_pull(request, request->len))
 		return NULL;
 
-	len = LL_RESERVED_SPACE(dev) + sizeof(struct ipv6hdr) +
+	headroom = LL_RESERVED_SPACE(dev);
+	len = headroom + sizeof(struct ipv6hdr) +
 		sizeof(*na) + na_olen + dev->needed_tailroom;
 	reply = alloc_skb(len, GFP_ATOMIC);
 	if (reply == NULL)
@@ -1972,7 +1974,7 @@ static struct sk_buff *vxlan_na_create(struct sk_buff *request,
 
 	reply->protocol = htons(ETH_P_IPV6);
 	reply->dev = dev;
-	skb_reserve(reply, LL_RESERVED_SPACE(request->dev));
+	skb_reserve(reply, headroom);
 	skb_push(reply, sizeof(struct ethhdr));
 	skb_reset_mac_header(reply);
 
-- 
2.48.1

Hi Sanghyun,
On Fri, Sep 18, 2026 at 12:26:58PM +0900, Sanghyun Park wrote:
> vxlan_na_create() samples LL_RESERVED_SPACE() to size the reply skb and then
> samples it again to reserve headroom. A concurrent vxlan_changelink() can
> update needed_headroom between the two reads, creating a TOCTOU race. The
> second value can exceed the allocation and make the Ethernet header write out
> of bounds.
> 
> The race is reproducible on the unpatched kernel. It occurred when
> vxlan_na_create() generated a neighbour reply while vxlan_changelink() changed
> the link headroom. KASAN caught a four-byte write two bytes beyond a 704-byte
> skbuff_small_head allocation.
> 
> Snapshot the headroom once and use that value for both allocation and
> reservation.

What if `vxlan_changelink()` extends the link headroom and we need a much
larger headroom, yet we only allocate a small skb from snapshot?

Thanks
Hangbin

> 
> Fixes: 4b29dba9c085 ("vxlan: fix nonfunctional neigh_reduce()")
> Signed-off-by: Sanghyun Park <sanghyun.park.cnu@gmail.com>
> ---
> v2:
>   - Improve the v1 changelog
> v1: https://lore.kernel.org/r/20260831054614.2069896-2-sanghyun.park.cnu@gmail.com
> 
>  drivers/net/vxlan/vxlan_core.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c
> index c1d54339fa2b..3390e341d1e5 100644
> --- a/drivers/net/vxlan/vxlan_core.c
> +++ b/drivers/net/vxlan/vxlan_core.c
> @@ -1958,13 +1958,15 @@ static struct sk_buff *vxlan_na_create(struct sk_buff *request,
>  	struct ipv6hdr *pip6;
>  	u8 *daddr;
>  	int na_olen = 8; /* opt hdr + ETH_ALEN for target */
> +	int headroom;
>  	int ns_olen;
>  	int i, len;
>  
>  	if (dev == NULL || !pskb_may_pull(request, request->len))
>  		return NULL;
>  
> -	len = LL_RESERVED_SPACE(dev) + sizeof(struct ipv6hdr) +
> +	headroom = LL_RESERVED_SPACE(dev);
> +	len = headroom + sizeof(struct ipv6hdr) +
>  		sizeof(*na) + na_olen + dev->needed_tailroom;
>  	reply = alloc_skb(len, GFP_ATOMIC);
>  	if (reply == NULL)
> @@ -1972,7 +1974,7 @@ static struct sk_buff *vxlan_na_create(struct sk_buff *request,
>  
>  	reply->protocol = htons(ETH_P_IPV6);
>  	reply->dev = dev;
> -	skb_reserve(reply, LL_RESERVED_SPACE(request->dev));
> +	skb_reserve(reply, headroom);
>  	skb_push(reply, sizeof(struct ethhdr));
>  	skb_reset_mac_header(reply);
>  
> -- 
> 2.48.1