Re: [PATCH net 3/5] vxlan: use neigh_ha_snapshot() in route_shortcircuit()

[Vadim Fedorenko <vadim.fedorenko@linux.dev>]

On 23/07/2026 15:42, Eric Dumazet wrote:
> The neighbour hardware address n->ha can be updated asynchronously by the
> neighbour subsystem, protected by n->ha_lock seqlock. Reading n->ha without
> holding the seqlock loop can lead to torn reads or reading a partially updated
> MAC address.
> 
> Use neigh_ha_snapshot() in route_shortcircuit() to safely copy n->ha under
> read_seqbegin()/read_seqretry() lock protection before using it.
> 
> Note that arp_reduce() and neigh_reduce() seem to have the same issue
> left for future patches.
> 
> Fixes: e4f67addf158 ("add DOVE extensions for VXLAN")
> Cc: stable@vger.kernel.org
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> ---
>   drivers/net/vxlan/vxlan_core.c | 6 ++++--
>   1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c
> index fb4a706cd5786d1937b1922acced31ffdb187c2f..10dd19eec09e266197ee51330a652f4e76c9643a 100644
> --- a/drivers/net/vxlan/vxlan_core.c
> +++ b/drivers/net/vxlan/vxlan_core.c
> @@ -2159,9 +2159,11 @@ static bool route_shortcircuit(struct net_device *dev, struct sk_buff *skb)
>   	}
>   
>   	if (n) {
> +		u8 haddr[ETH_ALEN];
>   		bool diff;
>   
> -		diff = !ether_addr_equal(eth_hdr(skb)->h_dest, n->ha);
> +		neigh_ha_snapshot(haddr, n, dev);
> +		diff = !ether_addr_equal_unaligned(eth_hdr(skb)->h_dest, haddr);
>   		if (diff) {
>   			if (skb_cow_head(skb, 0)) {
>   				neigh_release(n);
> @@ -2169,7 +2171,7 @@ static bool route_shortcircuit(struct net_device *dev, struct sk_buff *skb)
>   			}
>   			memcpy(eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest,
>   				dev->addr_len);
> -			memcpy(eth_hdr(skb)->h_dest, n->ha, dev->addr_len);
> +			memcpy(eth_hdr(skb)->h_dest, haddr, dev->addr_len);
>   		}
>   		neigh_release(n);
>   		return diff;

Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>