[PATCH net] vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes

[PATCH net] vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes

[Xiang Mei]

The VXLAN VNI filter entry policy declares the GROUP/GROUP6 address
attributes as NLA_BINARY with only a maximum length, so validate_nla()
accepts a payload shorter than the address. The GROUP consumer reads it
with nla_get_in_addr(), an unconditional 4-byte load, so a short
attribute over-reads up to 3 bytes of uninitialised slab data, which are
stored into remote_ip and echoed back via RTM_GETTUNNEL, disclosing
kernel memory.

Switch both entries to NLA_POLICY_EXACT_LEN() so the validator rejects
any GROUP/GROUP6 that is not exactly 4 / 16 bytes; a valid address is
always sent at full width.

Fixes: f9c4bb0b245c ("vxlan: vni filtering support on collect metadata device")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Xiang Mei <xmei5@asu.edu>
---
 drivers/net/vxlan/vxlan_vnifilter.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/net/vxlan/vxlan_vnifilter.c b/drivers/net/vxlan/vxlan_vnifilter.c
index 3e76f4e21094..dd94085e0886 100644
--- a/drivers/net/vxlan/vxlan_vnifilter.c
+++ b/drivers/net/vxlan/vxlan_vnifilter.c
@@ -462,10 +462,8 @@ static int vxlan_vnifilter_dump(struct sk_buff *skb, struct netlink_callback *cb
 static const struct nla_policy vni_filter_entry_policy[VXLAN_VNIFILTER_ENTRY_MAX + 1] = {
 	[VXLAN_VNIFILTER_ENTRY_START] = { .type = NLA_U32 },
 	[VXLAN_VNIFILTER_ENTRY_END] = { .type = NLA_U32 },
-	[VXLAN_VNIFILTER_ENTRY_GROUP]	= { .type = NLA_BINARY,
-					    .len = sizeof_field(struct iphdr, daddr) },
-	[VXLAN_VNIFILTER_ENTRY_GROUP6]	= { .type = NLA_BINARY,
-					    .len = sizeof(struct in6_addr) },
+	[VXLAN_VNIFILTER_ENTRY_GROUP]	= NLA_POLICY_EXACT_LEN(sizeof_field(struct iphdr, daddr)),
+	[VXLAN_VNIFILTER_ENTRY_GROUP6]	= NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)),
 };
 
 static const struct nla_policy vni_filter_policy[VXLAN_VNIFILTER_MAX + 1] = {
-- 
2.43.0

Re: [PATCH net] vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes

[kernel test robot]

:::::: 
:::::: Manual check reason: "clang compiler bug"
:::::: 

BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
In-Reply-To: <20260704222254.914567-1-xmei5@asu.edu>
References: <20260704222254.914567-1-xmei5@asu.edu>
TO: Xiang Mei <xmei5@asu.edu>
TO: Andrew Lunn <andrew+netdev@lunn.ch>
TO: "David S . Miller" <davem@davemloft.net>
TO: Eric Dumazet <edumazet@google.com>
TO: Jakub Kicinski <kuba@kernel.org>
TO: Paolo Abeni <pabeni@redhat.com>
TO: Roopa Prabhu <roopa@nvidia.com>
CC: netdev@vger.kernel.org
CC: linux-kernel@vger.kernel.org
CC: Petr Machata <petrm@nvidia.com>
CC: Andy Roulin <aroulin@nvidia.com>
CC: David Yang <mmyangfl@gmail.com>
CC: Kees Cook <kees@kernel.org>
CC: Weiming Shi <bestswngs@gmail.com>
CC: Xiang Mei <xmei5@asu.edu>

Hi Xiang,

kernel test robot noticed the following build errors:

[auto build test ERROR on net/main]

url:    https://github.com/intel-lab-lkp/linux/commits/Xiang-Mei/vxlan-vnifilter-enforce-exact-length-of-GROUP-GROUP6-attributes/20260705-062358
base:   net/main
patch link:    https://lore.kernel.org/r/20260704222254.914567-1-xmei5%40asu.edu
patch subject: [PATCH net] vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes
:::::: branch date: 3 days ago
:::::: commit date: 3 days ago
config: mips-randconfig-r123-20260705 (https://download.01.org/0day-ci/archive/20260708/202607080424.KSXDsyz9-lkp@intel.com/config)
compiler: clang version 23.0.0git (https://github.com/llvm/llvm-project 0a2fb2a2269da0e2a3e230beb6cad39ca314db33)
sparse: v0.6.5-rc1
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260708/202607080424.KSXDsyz9-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/r/202607080424.KSXDsyz9-lkp@intel.com/

Note: functions only called from assembly code should be annotated with the asmlinkage attribute
All errors (new ones prefixed by >>):

   PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and dumped files.
   Stack dump:
   0.	Program arguments: clang -Wp,-MMD,mm/.page_alloc.o.d -nostdinc -Iarch/mips/include -I./arch/mips/include/generated -Iinclude -I./include -Iarch/mips/include/uapi -I./arch/mips/include/generated/uapi -Iinclude/uapi -I./include/generated/uapi -include include/linux/compiler-version.h -include include/linux/kconfig.h -include include/linux/compiler_types.h -D__KERNEL__ --target=mipsel-linux-gnu -fintegrated-as -Werror=unknown-warning-option -Werror=ignored-optimization-argument -Werror=option-ignored -Werror=unused-command-line-argument -DVMLINUX_LOAD_ADDRESS=0xffffffff80040000 -DLINKER_LOAD_ADDRESS=0x80040000 -DDATAOFFSET=0 -fmacro-prefix-map== -Wundef -DKBUILD_EXTRA_WARN1 -fshort-wchar -funsigned-char -fno-common -fno-PIE -fno-strict-aliasing -std=gnu11 -fms-anonymous-structs -Wno-gnu -Wno-microsoft-anon-tag -mno-check-zero-division -mabi=32 -G 0 -mno-abicalls -fno-pic -pipe -msoft-float -Wa,-msoft-float -ffreestanding -EL -fno-stack-check -march=mips3 -Wa,--trap -DTOOLCHAIN_SUPPORTS_VIRT -Iarch/mips/include/asm/mach-dec -Iarch/mips/include/asm/mach-generic -fno-asynchronous-unwind-tables -fno-delete-null-pointer-checks -O2 -fstack-protector-strong -fomit-frame-pointer -ftrivial-auto-var-init=zero -falloc-token-max=16 -fexperimental-late-parse-attributes -fdiagnostics-show-inlining-chain -fstrict-flex-arrays=3 -fno-strict-overflow -fno-stack-check -fno-builtin-wcslen -Wall -Wextra -Wundef -Werror=implicit-function-declaration -Werror=implicit-int -Werror=return-type -Werror=strict-prototypes -Wno-format-security -Wno-trigraphs -Wno-frame-address -Wno-address-of-packed-member -Wmissing-declarations -Wmissing-prototypes -Wno-format-overflow-non-kprintf -Wno-format-truncation-non-kprintf -Wno-default-const-init-unsafe -Wno-type-limits -Wno-pointer-sign -Wcast-function-type -Wno-unterminated-string-initialization -Wimplicit-fallthrough -Werror=date-time -Werror=incompatible-pointer-types -Wenum-conversion -Wunused -Wmissing-format-attribute -Wmissing-include-dirs -Wunused-const-variable -Wno-missing-field-initializers -Wno-shift-negative-value -Wno-enum-enum-conversion -Wno-sign-compare -Wno-unused-parameter -DRANDSTRUCT -frandomize-layout-seed-file=./scripts/basic/randstruct.seed -fno-crash-diagnostics -Wno-error=return-type -Wreturn-type -funsigned-char -Wundef -falign-functions=64 -Imm -Imm -DKBUILD_MODFILE=\"mm/page-alloc\" -DKBUILD_BASENAME=\"page_alloc\" -DKBUILD_MODNAME=\"page_alloc\" -D__KBUILD_MODNAME=page_alloc -c -o mm/page_alloc.o mm/page_alloc.c
   1.	<eof> parser at end of file
   2.	Code generation
   3.	Running pass 'Function Pass Manager' on module 'mm/page_alloc.c'.
   4.	Running pass 'Branch Probability Basic Block Placement' on function '@post_alloc_hook'
    #0 0x000055c02e08613a llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (clang-23+0x3e6913a)
    #1 0x000055c02e083ce4 llvm::sys::CleanupOnSignal(unsigned long) (clang-23+0x3e66ce4)
    #2 0x000055c02dfb8cc0 CrashRecoverySignalHandler(int) CrashRecoveryContext.cpp:0:0
    #3 0x00007f746a3cddf0 (/lib/x86_64-linux-gnu/libc.so.6+0x3fdf0)
    #4 0x000055c02d6ace8f llvm::TailDuplicator::shouldTailDuplicate(bool, llvm::MachineBasicBlock&) (.part.0) TailDuplicator.cpp:0:0
    #5 0x000055c02d3f33ce (anonymous namespace)::MachineBlockPlacement::precomputeTriangleChains() MachineBlockPlacement.cpp:0:0
    #6 0x000055c02d400ffb (anonymous namespace)::MachineBlockPlacement::run(llvm::MachineFunction&) MachineBlockPlacement.cpp:0:0
    #7 0x000055c02d40440c (anonymous namespace)::MachineBlockPlacementLegacy::runOnMachineFunction(llvm::MachineFunction&) (.part.0) MachineBlockPlacement.cpp:0:0
    #8 0x000055c02d4466b3 llvm::MachineFunctionPass::runOnFunction(llvm::Function&) (clang-23+0x32296b3)
    #9 0x000055c02d994c79 llvm::FPPassManager::runOnFunction(llvm::Function&) (clang-23+0x3777c79)
   #10 0x000055c02d9950ac llvm::FPPassManager::runOnModule(llvm::Module&) (clang-23+0x37780ac)
   #11 0x000055c02d995c4a (anonymous namespace)::MPPassManager::runOnModule(llvm::Module&) LegacyPassManager.cpp:0:0
   #12 0x000055c02d99631c llvm::legacy::PassManagerImpl::run(llvm::Module&) (clang-23+0x377931c)
   #13 0x000055c02e42e1bf (anonymous namespace)::EmitAssemblyHelper::TimeCodegenPasses(llvm::function_ref<void ()>) BackendUtil.cpp:0:0
   #14 0x000055c02e43f5a4 (anonymous namespace)::EmitAssemblyHelper::emitAssembly(clang::BackendAction, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>, clang::BackendConsumer*) (.constprop.0) BackendUtil.cpp:0:0
   #15 0x000055c02e43f7f7 clang::emitBackendOutput(clang::CompilerInstance&, clang::CodeGenOptions&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>, clang::BackendConsumer*) (clang-23+0x42227f7)
   #16 0x000055c02ea74047 clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) (clang-23+0x4857047)
   #17 0x000055c03046f99c clang::ParseAST(clang::Sema&, bool, bool) (clang-23+0x625299c)
   #18 0x000055c02edd781e clang::FrontendAction::Execute() (clang-23+0x4bba81e)
   #19 0x000055c02ed60b9e clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (clang-23+0x4b43b9e)
   #20 0x000055c02eec0dc7 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (clang-23+0x4ca3dc7)
   #21 0x000055c02b0f4738 cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (clang-23+0xed7738)
   #22 0x000055c02b0ec413 ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&, llvm::ToolContext const&, llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>) driver.cpp:0:0
   #23 0x000055c02b0ec453 int llvm::function_ref<int (llvm::SmallVectorImpl<char const*>&)>::callback_fn<clang_main(int, char**, llvm::ToolContext const&)::'lambda'(llvm::SmallVectorImpl<char const*>&)>(long, llvm::SmallVectorImpl<char const*>&) driver.cpp:0:0
   #24 0x000055c02eaed5f9 void llvm::function_ref<void ()>::callback_fn<clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const::'lambda'()>(long) Job.cpp:0:0
   #25 0x000055c02dfb9023 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref<void ()>) (clang-23+0x3d9c023)
   #26 0x000055c02eaeeb4c clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const (.part.0) Job.cpp:0:0
   #27 0x000055c02eaaa228 clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const (clang-23+0x488d228)
   #28 0x000055c02eaab1c2 clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&, bool) const (clang-23+0x488e1c2)
   #29 0x000055c02eabea0c clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&) (clang-23+0x48a1a0c)
   #30 0x000055c02b0f10d2 clang_main(int, char**, llvm::ToolContext const&) (clang-23+0xed40d2)
   #31 0x000055c02b005df9 main (clang-23+0xde8df9)
   #32 0x00007f746a3b7ca8 (/lib/x86_64-linux-gnu/libc.so.6+0x29ca8)
   #33 0x00007f746a3b7d65 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29d65)
   #34 0x000055c02b0ebe71 _start (clang-23+0xecee71)
   clang: error: clang frontend command failed due to signal (use -v to see invocation)
>> /bin/bash: line 1: 2718805 Segmentation fault      clang -Wp,-MMD,mm/.page_alloc.o.d -nostdinc -Iarch/mips/include -I./arch/mips/include/generated -Iinclude -I./include -Iarch/mips/include/uapi -I./arch/mips/include/generated/uapi -Iinclude/uapi -I./include/generated/uapi -include include/linux/compiler-version.h -include include/linux/kconfig.h -include include/linux/compiler_types.h -D__KERNEL__ --target=mipsel-linux-gnu -fintegrated-as -Werror=unknown-warning-option -Werror=ignored-optimization-argument -Werror=option-ignored -Werror=unused-command-line-argument -DVMLINUX_LOAD_ADDRESS=0xffffffff80040000 -DLINKER_LOAD_ADDRESS=0x80040000 -DDATAOFFSET=0 -fmacro-prefix-map== -Wundef -DKBUILD_EXTRA_WARN1 -fshort-wchar -funsigned-char -fno-common -fno-PIE -fno-strict-aliasing -std=gnu11 -fms-anonymous-structs -Wno-gnu -Wno-microsoft-anon-tag -mno-check-zero-division -mabi=32 -G 0 -mno-abicalls -fno-pic -pipe -msoft-float -Wa,-msoft-float -ffreestanding -EL -fno-stack-check -march=mips3 -Wa,--trap -DTOOLCHAIN_SUPPORTS_VIRT -Iarch/mips/include/asm/mach-dec -Iarch/mips/include/asm/mach-generic -fno-asynchronous-unwind-tables -fno-delete-null-pointer-checks -O2 -fstack-protector-strong -fomit-frame-pointer -ftrivial-auto-var-init=zero -falloc-token-max=16 -fexperimental-late-parse-attributes -fdiagnostics-show-inlining-chain -fstrict-flex-arrays=3 -fno-strict-overflow -fno-stack-check -fno-builtin-wcslen -Wall -Wextra -Wundef -Werror=implicit-function-declaration -Werror=implicit-int -Werror=return-type -Werror=strict-prototypes -Wno-format-security -Wno-trigraphs -Wno-frame-address -Wno-address-of-packed-member -Wmissing-declarations -Wmissing-prototypes -Wno-format-overflow-non-kprintf -Wno-format-truncation-non-kprintf -Wno-default-const-init-unsafe -Wno-type-limits -Wno-pointer-sign -Wcast-function-type -Wno-unterminated-string-initialization -Wimplicit-fallthrough -Werror=date-time -Werror=incompatible-pointer-types -Wenum-conversion -Wunused -Wmissing-format-attribute -Wmissing-include-dirs -Wunused-const-variable -Wno-missing-field-initializers -Wno-shift-negative-value -Wno-enum-enum-conversion -Wno-sign-compare -Wno-unused-parameter -DRANDSTRUCT -frandomize-layout-seed-file=./scripts/basic/randstruct.seed -fno-crash-diagnostics -Wno-error=return-type -Wreturn-type -funsigned-char -Wundef -falign-functions=64 -Imm -Imm -DKBUILD_MODFILE='"mm/page-alloc"' -DKBUILD_BASENAME='"page_alloc"' -DKBUILD_MODNAME='"page_alloc"' -D__KBUILD_MODNAME=page_alloc -c -o mm/page_alloc.o mm/page_alloc.c

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH net] vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes

[Ido Schimmel]

On Sat, Jul 04, 2026 at 03:22:54PM -0700, Xiang Mei wrote:
> The VXLAN VNI filter entry policy declares the GROUP/GROUP6 address
> attributes as NLA_BINARY with only a maximum length, so validate_nla()
> accepts a payload shorter than the address. The GROUP consumer reads it
> with nla_get_in_addr(), an unconditional 4-byte load, so a short
> attribute over-reads up to 3 bytes of uninitialised slab data, which are
> stored into remote_ip and echoed back via RTM_GETTUNNEL, disclosing
> kernel memory.
> 
> Switch both entries to NLA_POLICY_EXACT_LEN() so the validator rejects
> any GROUP/GROUP6 that is not exactly 4 / 16 bytes; a valid address is
> always sent at full width.
> 
> Fixes: f9c4bb0b245c ("vxlan: vni filtering support on collect metadata device")
> Reported-by: Weiming Shi <bestswngs@gmail.com>
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: Xiang Mei <xmei5@asu.edu>

Reviewed-by: Ido Schimmel <idosch@nvidia.com>