Re: [PATCH net] vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del()

[Ido Schimmel <idosch@nvidia.com>]

On Thu, Aug 27, 2026 at 12:15:42AM +0900, Baul Lee wrote:
> diff --git a/drivers/net/vxlan/vxlan_mdb.c b/drivers/net/vxlan/vxlan_mdb.c
> index d71e1925ecfd..7986c5b5dc67 100644
> --- a/drivers/net/vxlan/vxlan_mdb.c
> +++ b/drivers/net/vxlan/vxlan_mdb.c
> @@ -354,6 +354,10 @@ static bool vxlan_mdb_is_valid_source(const struct nlattr *attr, __be16 proto,
>  			NL_SET_ERR_MSG_MOD(extack, "IPv4 multicast source address is not allowed");
>  			return false;
>  		}
> +		if (nla_get_in_addr(attr) == htonl(INADDR_ANY)) {

Maybe:

if (ipv4_is_zeronet(nla_get_in_addr(attr)))

It's consistent with the ipv4_is_multicast() check above it.

> +			NL_SET_ERR_MSG_MOD(extack, "IPv4 all-zeros source address is not allowed");
> +			return false;
> +		}
>  		break;
>  #if IS_ENABLED(CONFIG_IPV6)
>  	case htons(ETH_P_IPV6): {
> @@ -368,6 +372,10 @@ static bool vxlan_mdb_is_valid_source(const struct nlattr *attr, __be16 proto,
>  			NL_SET_ERR_MSG_MOD(extack, "IPv6 multicast source address is not allowed");
>  			return false;
>  		}
> +		if (ipv6_addr_any(&src)) {
> +			NL_SET_ERR_MSG_MOD(extack, "IPv6 all-zeros source address is not allowed");
> +			return false;
> +		}

This looks fine.

Please add a test case in star_g_common() and sg_common() at
tools/testing/selftests/net/test_vxlan_mdb.sh. You can squash it into
this patch. We already have test cases for error cases there.

BTW, are you going to send v2 for [1]?

Thanks

[1] https://lore.kernel.org/netdev/20260815172032.79740-1-baul.lee@xbow.com/