[PATCH net] vxlan: annotate lockless accesses to rdst->remote_ifindex

[PATCH net] vxlan: annotate lockless accesses to rdst->remote_ifindex

[Eric Dumazet]

vxlan_fdb_replace() can update rd->remote_ifindex in place while
the destination entry is visible to concurrent lockless RCU readers:

- vxlan_fdb_info() reads rdst->remote_ifindex during RCU-protected
  FDB dumps and gets.
- vxlan_fdb_switchdev_notifier_info() reads rd->remote_ifindex from
  vxlan_fdb_find_uc().
- vxlan_snoop() reads rdst->remote_ifindex on the RX path.
- vxlan_xmit_one() reads rdst->remote_ifindex on the TX path.

Annotate these accesses with READ_ONCE() and WRITE_ONCE().

Fixes: 906dc186e020 ("vxlan fdb replace an existing entry")
Fixes: 87613de95041 ("vxlan: fix snooping for link-local IPv6 addresses")
Fixes: 49f810f00fa3 ("vxlan: allow multiple VXLANs with same VNI for IPv6 link-local addresses")
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
---
Cc: Andrew Lunn <andrew+netdev@lunn.ch
---
 drivers/net/vxlan/vxlan_core.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c
index d11028b374721c9f4691254edb61a55c679fd2f2..13bfb1bb11b7be4d4e224d7f892c960512301b2e 100644
--- a/drivers/net/vxlan/vxlan_core.c
+++ b/drivers/net/vxlan/vxlan_core.c
@@ -215,6 +215,8 @@ static int vxlan_fdb_info(struct sk_buff *skb, struct vxlan_dev *vxlan,
 		if (nla_put_u32(skb, NDA_NH_ID, nh_id))
 			goto nla_put_failure;
 	} else if (rdst) {
+		u32 remote_ifindex;
+
 		if (send_ip && vxlan_nla_put_addr(skb, NDA_DST,
 						  &rdst->remote_ip))
 			goto nla_put_failure;
@@ -226,8 +228,9 @@ static int vxlan_fdb_info(struct sk_buff *skb, struct vxlan_dev *vxlan,
 		if (rdst->remote_vni != cfg->vni &&
 		    nla_put_u32(skb, NDA_VNI, be32_to_cpu(rdst->remote_vni)))
 			goto nla_put_failure;
-		if (rdst->remote_ifindex &&
-		    nla_put_u32(skb, NDA_IFINDEX, rdst->remote_ifindex))
+		remote_ifindex = READ_ONCE(rdst->remote_ifindex);
+		if (remote_ifindex &&
+		    nla_put_u32(skb, NDA_IFINDEX, remote_ifindex))
 			goto nla_put_failure;
 	}
 
@@ -300,7 +303,7 @@ static void vxlan_fdb_switchdev_notifier_info(const struct vxlan_dev *vxlan,
 	fdb_info->remote_ip = rd->remote_ip;
 	fdb_info->remote_port = rd->remote_port;
 	fdb_info->remote_vni = rd->remote_vni;
-	fdb_info->remote_ifindex = rd->remote_ifindex;
+	fdb_info->remote_ifindex = READ_ONCE(rd->remote_ifindex);
 	memcpy(fdb_info->eth_addr, fdb->key.eth_addr, ETH_ALEN);
 	fdb_info->vni = fdb->key.vni;
 	fdb_info->offloaded = rd->offloaded;
@@ -569,7 +572,7 @@ static int vxlan_fdb_replace(struct vxlan_fdb *f,
 	rd->remote_ip = *ip;
 	rd->remote_port = port;
 	rd->remote_vni = vni;
-	rd->remote_ifindex = ifindex;
+	WRITE_ONCE(rd->remote_ifindex, ifindex);
 	rd->offloaded = false;
 	return 1;
 }
@@ -1470,7 +1473,7 @@ static enum skb_drop_reason vxlan_snoop(struct net_device *dev,
 			return SKB_DROP_REASON_VXLAN_ENTRY_EXISTS;
 
 		if (likely(vxlan_addr_equal(&rdst->remote_ip, src_ip) &&
-			   rdst->remote_ifindex == ifindex))
+			   READ_ONCE(rdst->remote_ifindex) == ifindex))
 			return SKB_NOT_DROPPED_YET;
 
 		/* Don't migrate static entries, drop packets */
@@ -2442,7 +2445,7 @@ void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
 		addr_family = cfg->saddr.sa.sa_family;
 		dst_port = rdst->remote_port ? rdst->remote_port : cfg->dst_port;
 		vni = (rdst->remote_vni) ? : default_vni;
-		ifindex = rdst->remote_ifindex;
+		ifindex = READ_ONCE(rdst->remote_ifindex);
 
 		if (addr_family == AF_INET) {
 			key.u.ipv4.src = cfg->saddr.sin.sin_addr.s_addr;
-- 
2.53.0

Re: [PATCH net] vxlan: annotate lockless accesses to rdst->remote_ifindex

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by code inspection). If it was triggered please include
   the symptoms, like the stack trace or error messages.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH net] vxlan: annotate lockless accesses to rdst->remote_ifindex

[Eric Dumazet]

Le mar. 10 nov. 2026 à 08:26, <netdev-bot+sinfo@kernel.org> a écrit :
>
> Hi!
>
> This is an automated message. This series looks like a fix, but its
> commit messages seem to be missing some information:
>
>  - How the issue was discovered, e.g. hit in production, hit during
>    development, syzbot report, manual code inspection, LLM or static
>    analysis tool scan.
>

Manual code inspection, I am not aware of a syzbot report.

>  - Whether the issue was actually triggered, or is only theoretical
>    (e.g. found by code inspection). If it was triggered please include
>    the symptoms, like the stack trace or error messages.
>
> Please do not repost the series just to address the above. Instead,
> reply to this email with the missing information, so that reviewers
> can take it into account. If the series needs another revision for
> other reasons, please include the information in the commit messages
> then.
>
> The evaluation is done by an LLM so it may be wrong, if you think
> that is the case please reply and explain.

Re: [PATCH net] vxlan: annotate lockless accesses to rdst->remote_ifindex

[netdev-bot+sashiko]

Thank you for your contribution! Sashiko AI review found 1 potential
issue(s) to consider.

Critical: 0 · High: 1 · Medium: 0 · Low: 0

If you believe none of the issues are legitimate, please reply to each
issue of Medium severity or higher and explain why the AI is wrong.
If any of them are legitimate and you plan to respin, please let patchwork
know by including "pw-bot: cr" as a separate line at the end of your reply
(one such reply per series is enough).

- [High] Rolling back a failed FDB replace still writes
  rdst->remote_ifindex with a plain store, so the patch misses one of…

--

vxlan: annotate lockless accesses to rdst->remote_ifindex

The patch adds READ_ONCE() to the lockless RCU readers of
rdst->remote_ifindex in vxlan_fdb_info(),
vxlan_fdb_switchdev_notifier_info(), vxlan_snoop() and vxlan_xmit_one().
It also changes the in-place update in vxlan_fdb_replace() to use
WRITE_ONCE().

> diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c
> index d11028b374721..13bfb1bb11b7b 100644
> --- a/drivers/net/vxlan/vxlan_core.c
> +++ b/drivers/net/vxlan/vxlan_core.c

[ ... ]

> @@ -569,7 +572,7 @@ static int vxlan_fdb_replace(struct vxlan_fdb *f,
>  	rd->remote_ip = *ip;
>  	rd->remote_port = port;
>  	rd->remote_vni = vni;
> -	rd->remote_ifindex = ifindex;
> +	WRITE_ONCE(rd->remote_ifindex, ifindex);
>  	rd->offloaded = false;
>  	return 1;
>  }

[Severity: High]
This annotates the forward write in vxlan_fdb_replace(). Is the rollback
of the same write in vxlan_fdb_update_existing() still a plain store?

drivers/net/vxlan/vxlan_core.c:vxlan_fdb_update_existing() {
    ...
		err = vxlan_fdb_notify(vxlan, f, rd, RTM_NEWNEIGH,
				       swdev_notify, extack);
		if (err)
			goto err_notify;
    ...
err_notify:
	if (nhid)
		return err;
	if ((flags & NLM_F_REPLACE) && rc)
		*rd = oldrd;
    ...
}

When vxlan_fdb_notify() fails after vxlan_fdb_replace() has run, the
struct copy rewrites rd->remote_ifindex on an rdst that is still linked
on f->remotes. Only vxlan->hash_lock is held. vxlan_xmit_one(),
vxlan_snoop() and the RCU dump paths can be reading the field with the
new READ_ONCE() at the same time.

This path can be reached in tree. mlxsw_sp_switchdev_vxlan_work_prepare()
returns -EOPNOTSUPP for a non-zero remote_ifindex ("Local interface is
not supported"), a non-default port or VNI, or a multicast destination.
It also fails if its GFP_ATOMIC allocation fails. The result is
NOTIFY_BAD, and vxlan_fdb_notify() then returns an error. So a
"bridge fdb replace ... via <dev>" on an mlxsw-offloaded VXLAN goes
through WRITE_ONCE() and then a plain-store restore while traffic is
flowing.

Would it make sense to restore the fields one at a time in err_notify,
using WRITE_ONCE(rd->remote_ifindex, oldrd.remote_ifindex)?

A related point about the same struct copy: it also copies the old
rd->dst_cache back, including reset_ts from before the
dst_cache_reset() in vxlan_fdb_replace(). Could a dst that TX cached
for the rejected destination during that window count as valid again
once the old destination is restored? Calling dst_cache_reset() again
in the rollback, instead of copying dst_cache back, would avoid that.

-- 
Sashiko AI review · https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261110072208.3273638-1-edumazet%40kernel.org