Re: [PATCH net 1/5] vxlan: re-fetch eth header after route_shortcircuit()

[Vadim Fedorenko <vadim.fedorenko@linux.dev>]

On 23/07/2026 15:42, Eric Dumazet wrote:
> Before route_shortcircuit(), the eth header pointer is cached from eth_hdr(skb).
> 
> Inside route_shortcircuit(), pskb_may_pull() can be called, which may
> reallocate skb->head.
> 
> In this case, returning to vxlan_xmit() leaves the cached eth pointer pointing to
> freed memory, leading to a use-after-free when dereferencing eth->h_dest.
> 
> Fix this by updating eth = eth_hdr(skb) after calling route_shortcircuit().
> 
> Fixes: ae8840825605 ("VXLAN: Allow L2 redirection with L3 switching")
> Cc: stable@vger.kernel.org
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> ---
>   drivers/net/vxlan/vxlan_core.c | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c
> index 67c367cc566233e809b0f70e0d939dd1c1ac0d9f..9060a1259ac283d4db4b7a854ce74203496e9313 100644
> --- a/drivers/net/vxlan/vxlan_core.c
> +++ b/drivers/net/vxlan/vxlan_core.c
> @@ -2796,6 +2796,7 @@ static netdev_tx_t vxlan_xmit(struct sk_buff *skb, struct net_device *dev)
>   	    (ntohs(eth->h_proto) == ETH_P_IP ||
>   	     ntohs(eth->h_proto) == ETH_P_IPV6)) {
>   		did_rsc = route_shortcircuit(dev, skb);
> +		eth = eth_hdr(skb);
>   		if (did_rsc)
>   			f = vxlan_find_mac_tx(vxlan, eth->h_dest, vni);
>   	}
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>