Re: [PATCH net] net: vxlan: prevent NULL deref in vxlan_xmit_one

[Jakub Kicinski <kuba@kernel.org>]

On Mon, 24 Nov 2025 17:30:59 +0100 Antoine Tenart wrote:
> Neither sock4 nor sock6 pointers are guaranteed to be non-NULL in
> vxlan_xmit_one, e.g. if the iface is brought down. This can lead to the
> following NULL dereference:
> 
>   BUG: kernel NULL pointer dereference, address: 0000000000000010
>   Oops: Oops: 0000 [#1] SMP NOPTI
>   RIP: 0010:vxlan_xmit_one+0xbb3/0x1580
>   Call Trace:
>    vxlan_xmit+0x429/0x610
>    dev_hard_start_xmit+0x55/0xa0
>    __dev_queue_xmit+0x6d0/0x7f0
>    ip_finish_output2+0x24b/0x590
>    ip_output+0x63/0x110
> 
> Mentioned commits changed the code path in vxlan_xmit_one and as a side
> effect the sock4/6 pointer validity checks in vxlan(6)_get_route were
> lost. Fix this by adding back checks.
> 
> Since both commits being fixed were released in the same version (v6.7)
> and are strongly related, bundle the fixes in a single commit.
> 
> Reported-by: Liang Li <liali@redhat.com>
> Fixes: 6f19b2c136d9 ("vxlan: use generic function for tunnel IPv4 route lookup")
> Fixes: 2aceb896ee18 ("vxlan: use generic function for tunnel IPv6 route lookup")
> Cc: Beniamino Galvani <b.galvani@gmail.com>
> Signed-off-by: Antoine Tenart <atenart@kernel.org>

clang sayeth:

../drivers/net/vxlan/vxlan_core.c:2548:7: warning: variable 'err' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized]
 2548 |                 if (unlikely(!sock6)) {
      |                     ^~~~~~~~~~~~~~~~
../include/linux/compiler.h:77:22: note: expanded from macro 'unlikely'
   77 | # define unlikely(x)    __builtin_expect(!!(x), 0)
      |                         ^~~~~~~~~~~~~~~~~~~~~~~~~~
../drivers/net/vxlan/vxlan_core.c:2631:6: note: uninitialized use occurs here
 2631 |         if (err == -ELOOP)
      |             ^~~
../drivers/net/vxlan/vxlan_core.c:2548:3: note: remove the 'if' if its condition is always false
 2548 |                 if (unlikely(!sock6)) {
      |                 ^~~~~~~~~~~~~~~~~~~~~~~
 2549 |                         reason = SKB_DROP_REASON_DEV_READY;
      |                         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 2550 |                         goto tx_error;
      |                         ~~~~~~~~~~~~~~
 2551 |                 }
      |                 ~
../drivers/net/vxlan/vxlan_core.c:2464:7: warning: variable 'err' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized]
 2464 |                 if (unlikely(!sock4)) {
      |                     ^~~~~~~~~~~~~~~~
../include/linux/compiler.h:77:22: note: expanded from macro 'unlikely'
   77 | # define unlikely(x)    __builtin_expect(!!(x), 0)
      |                         ^~~~~~~~~~~~~~~~~~~~~~~~~~
../drivers/net/vxlan/vxlan_core.c:2631:6: note: uninitialized use occurs here
 2631 |         if (err == -ELOOP)
      |             ^~~
../drivers/net/vxlan/vxlan_core.c:2464:3: note: remove the 'if' if its condition is always false
 2464 |                 if (unlikely(!sock4)) {
      |                 ^~~~~~~~~~~~~~~~~~~~~~~
 2465 |                         reason = SKB_DROP_REASON_DEV_READY;
      |                         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 2466 |                         goto tx_error;
      |                         ~~~~~~~~~~~~~~
 2467 |                 }
      |                 ~
../drivers/net/vxlan/vxlan_core.c:2352:9: note: initialize the variable 'err' to silence this warning
 2352 |         int err;
      |                ^
      |                 = 0
-- 
pw-bot: cr