[PATCH net 0/5] vxlan: fixes for skb header pulling, cloning, and concurrency in TX path

[Eric Dumazet <edumazet@google.com>]

While working on RTNL-less fill_info for vxlan, Sashiko found annoying
pre-existing issues, adding noise to an already complex work.

This series addresses some of them in VXLAN transmit path,
primarily within route_shortcircuit(), header validation, and neighbour lookup.

Patch 1 fixes a potential use-after-free in vxlan_xmit() caused by caching
the Ethernet header pointer ('eth') before calling route_shortcircuit(), which
can reallocate skb->head via pskb_may_pull().

Patch 2 calls skb_cow_head() in route_shortcircuit() before modifying the
Ethernet header in-place, preventing packet header corruption when the skb
is cloned (e.g., by packet sockets, tcpdump, or dev_queue_xmit).

Patch 3 replaces direct reads of n->ha in route_shortcircuit() with
neigh_ha_snapshot() to safely snapshot the neighbour hardware address under
seqlock protection, avoiding potential torn reads during asynchronous updates.

Patch 4 changes route_shortcircuit() to use pskb_network_may_pull() instead
of pskb_may_pull(). Since skb->data points to the MAC header on transmit
(skb_network_offset(skb) == ETH_HLEN), pskb_may_pull() was only checking 6
bytes into the IP header, leaving the remainder un-pulled in non-linear frags.

Patch 5 applies pskb_network_may_pull() to the remaining transmit-path header
pull checks in arp_reduce(), ND solicitation proxy checks, and MDB entry lookup,
where skb->data similarly points to the Ethernet header.

Eric Dumazet (5):
  vxlan: re-fetch eth header after route_shortcircuit()
  vxlan: unclone skb head before modifying eth header in
    route_shortcircuit()
  vxlan: use neigh_ha_snapshot() in route_shortcircuit()
  vxlan: use pskb_network_may_pull() in route_shortcircuit()
  vxlan: use pskb_network_may_pull() for transmit path header pulls

 drivers/net/vxlan/vxlan_core.c | 21 ++++++++++++++-------
 drivers/net/vxlan/vxlan_mdb.c  |  4 ++--
 2 files changed, 16 insertions(+), 9 deletions(-)

-- 
2.55.0.229.g6434b31f56-goog