[PATCH net] vxlan: add missing NULL check for vxlan_sock in GRO path

[PATCH net] vxlan: add missing NULL check for vxlan_sock in GRO path

[Xiang Mei (Microsoft)]

vxlan_gro_prepare_receive() reads vs->flags from the vxlan_sock returned
by rcu_dereference_sk_user_data(sk) without a NULL check, unlike the rest
of the driver (e.g. vxlan_rcv() does "if (!vs) goto drop;").

udp_tunnel_sock_release() clears sk_user_data to NULL and waits an RCU
grace period before the socket leaves the hash, so any callback running on
the tunnel socket during teardown must tolerate a NULL sk_user_data. If a
VXLAN device is torn down while GRO runs on its UDP tunnel socket,
sk_user_data can be NULL when a packet carrying VXLAN_HF_RCO arrives,
faulting in NAPI/softirq context.

The GRO path was the only sk_user_data reader on the socket missing this
guard (vxlan_rcv and vxlan_err_lookup already have it; the gro_complete
callbacks do not touch sk_user_data). Add the same NULL check so GRO
flushes instead of dereferencing a NULL socket pointer.

  Oops: general protection fault ... SMP KASAN NOPTI
  KASAN: probably user-memory-access in range [0x2018-0x201f]
  RIP: 0010:vxlan_gro_prepare_receive (drivers/net/vxlan/vxlan_core.c:678)
   vxlan_gro_receive (drivers/net/vxlan/vxlan_core.c:713)
   udp_gro_receive (net/ipv4/udp_offload.c:841)
   ...
   dev_gro_receive (net/core/gro.c:522)
   gro_receive_skb (net/core/gro.c:640)
   tun_napi_poll (drivers/net/tun.c:259)
   ...
  Kernel panic - not syncing: Fatal exception in interrupt

Fixes: 5602c48cf875 ("vxlan: change vxlan to use UDP socket GRO")
Reported-by: AutonomousCodeSecurity@microsoft.com
Signed-off-by: Xiang Mei (Microsoft) <xmei5@asu.edu>
---
 drivers/net/vxlan/vxlan_core.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c
index b5b1253ac08b..f2235bae9bfe 100644
--- a/drivers/net/vxlan/vxlan_core.c
+++ b/drivers/net/vxlan/vxlan_core.c
@@ -663,6 +663,9 @@ static struct vxlanhdr *vxlan_gro_prepare_receive(struct sock *sk,
 	struct vxlan_sock *vs = rcu_dereference_sk_user_data(sk);
 	__be32 flags;
 
+	if (!vs)
+		return NULL;
+
 	skb_gro_remcsum_init(grc);
 
 	off_vx = skb_gro_offset(skb);
-- 
2.43.0

Re: [PATCH net] vxlan: add missing NULL check for vxlan_sock in GRO path

[Kuniyuki Iwashima]

From: "Xiang Mei (Microsoft)" <xmei5@asu.edu>
Date: Mon,  6 Jul 2026 23:33:44 +0000
> vxlan_gro_prepare_receive() reads vs->flags from the vxlan_sock returned
> by rcu_dereference_sk_user_data(sk) without a NULL check, unlike the rest
> of the driver (e.g. vxlan_rcv() does "if (!vs) goto drop;").
> 
> udp_tunnel_sock_release() clears sk_user_data to NULL and waits an RCU
> grace period before the socket leaves the hash, so any callback running on
> the tunnel socket during teardown must tolerate a NULL sk_user_data. If a
> VXLAN device is torn down while GRO runs on its UDP tunnel socket,
> sk_user_data can be NULL when a packet carrying VXLAN_HF_RCO arrives,
> faulting in NAPI/softirq context.
> 
> The GRO path was the only sk_user_data reader on the socket missing this
> guard (vxlan_rcv and vxlan_err_lookup already have it; the gro_complete
> callbacks do not touch sk_user_data). Add the same NULL check so GRO
> flushes instead of dereferencing a NULL socket pointer.
> 
>   Oops: general protection fault ... SMP KASAN NOPTI
>   KASAN: probably user-memory-access in range [0x2018-0x201f]
>   RIP: 0010:vxlan_gro_prepare_receive (drivers/net/vxlan/vxlan_core.c:678)
>    vxlan_gro_receive (drivers/net/vxlan/vxlan_core.c:713)
>    udp_gro_receive (net/ipv4/udp_offload.c:841)
>    ...
>    dev_gro_receive (net/core/gro.c:522)
>    gro_receive_skb (net/core/gro.c:640)
>    tun_napi_poll (drivers/net/tun.c:259)
>    ...
>   Kernel panic - not syncing: Fatal exception in interrupt
> 
> Fixes: 5602c48cf875 ("vxlan: change vxlan to use UDP socket GRO")
> Reported-by: AutonomousCodeSecurity@microsoft.com
> Signed-off-by: Xiang Mei (Microsoft) <xmei5@asu.edu>
> ---
>  drivers/net/vxlan/vxlan_core.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c
> index b5b1253ac08b..f2235bae9bfe 100644
> --- a/drivers/net/vxlan/vxlan_core.c
> +++ b/drivers/net/vxlan/vxlan_core.c
> @@ -663,6 +663,9 @@ static struct vxlanhdr *vxlan_gro_prepare_receive(struct sock *sk,
>  	struct vxlan_sock *vs = rcu_dereference_sk_user_data(sk);
>  	__be32 flags;
>  
> +	if (!vs)
> +		return NULL;

Please work on the latest tree, it's fixed 2 months ago.

commit 30a45c0bffdd62350261e2f2689fdba426a33578
Author: Kuniyuki Iwashima <kuniyu@google.com>
Date:   Sat May 2 03:12:59 2026

    vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().

Re: [PATCH net] vxlan: add missing NULL check for vxlan_sock in GRO path

[Xiang Mei]

On Mon, Jul 6, 2026 at 4:56 PM Kuniyuki Iwashima <kuniyu@google.com> wrote:
>
> From: "Xiang Mei (Microsoft)" <xmei5@asu.edu>
> Date: Mon,  6 Jul 2026 23:33:44 +0000
> > vxlan_gro_prepare_receive() reads vs->flags from the vxlan_sock returned
> > by rcu_dereference_sk_user_data(sk) without a NULL check, unlike the rest
> > of the driver (e.g. vxlan_rcv() does "if (!vs) goto drop;").
> >
> > udp_tunnel_sock_release() clears sk_user_data to NULL and waits an RCU
> > grace period before the socket leaves the hash, so any callback running on
> > the tunnel socket during teardown must tolerate a NULL sk_user_data. If a
> > VXLAN device is torn down while GRO runs on its UDP tunnel socket,
> > sk_user_data can be NULL when a packet carrying VXLAN_HF_RCO arrives,
> > faulting in NAPI/softirq context.
> >
> > The GRO path was the only sk_user_data reader on the socket missing this
> > guard (vxlan_rcv and vxlan_err_lookup already have it; the gro_complete
> > callbacks do not touch sk_user_data). Add the same NULL check so GRO
> > flushes instead of dereferencing a NULL socket pointer.
> >
> >   Oops: general protection fault ... SMP KASAN NOPTI
> >   KASAN: probably user-memory-access in range [0x2018-0x201f]
> >   RIP: 0010:vxlan_gro_prepare_receive (drivers/net/vxlan/vxlan_core.c:678)
> >    vxlan_gro_receive (drivers/net/vxlan/vxlan_core.c:713)
> >    udp_gro_receive (net/ipv4/udp_offload.c:841)
> >    ...
> >    dev_gro_receive (net/core/gro.c:522)
> >    gro_receive_skb (net/core/gro.c:640)
> >    tun_napi_poll (drivers/net/tun.c:259)
> >    ...
> >   Kernel panic - not syncing: Fatal exception in interrupt
> >
> > Fixes: 5602c48cf875 ("vxlan: change vxlan to use UDP socket GRO")
> > Reported-by: AutonomousCodeSecurity@microsoft.com
> > Signed-off-by: Xiang Mei (Microsoft) <xmei5@asu.edu>
> > ---
> >  drivers/net/vxlan/vxlan_core.c | 3 +++
> >  1 file changed, 3 insertions(+)
> >
> > diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c
> > index b5b1253ac08b..f2235bae9bfe 100644
> > --- a/drivers/net/vxlan/vxlan_core.c
> > +++ b/drivers/net/vxlan/vxlan_core.c
> > @@ -663,6 +663,9 @@ static struct vxlanhdr *vxlan_gro_prepare_receive(struct sock *sk,
> >       struct vxlan_sock *vs = rcu_dereference_sk_user_data(sk);
> >       __be32 flags;
> >
> > +     if (!vs)
> > +             return NULL;
>
> Please work on the latest tree, it's fixed 2 months ago.
>
Thanks for the reminder. I apologize for my mistake.

Xiang

> commit 30a45c0bffdd62350261e2f2689fdba426a33578
> Author: Kuniyuki Iwashima <kuniyu@google.com>
> Date:   Sat May 2 03:12:59 2026
>
>     vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().