Re: [PATCH net 4/5] vxlan: use pskb_network_may_pull() in route_shortcircuit()

[Vadim Fedorenko <vadim.fedorenko@linux.dev>]

On 23/07/2026 15:42, Eric Dumazet wrote:
> route_shortcircuit() currently calls pskb_may_pull(skb, sizeof(struct iphdr))
> (or ipv6hdr), which checks if bytes are available starting from skb->data.
> 
> However, in vxlan_xmit(), skb->data points to the MAC header, so
> skb_network_offset(skb) is ETH_HLEN (14 bytes). Using pskb_may_pull(skb, 20)
> only checks 20 bytes from skb->data (which is 14 bytes MAC header + 6 bytes of
> IP header), leaving the rest of the IP header potentially un-pulled in non-linear
> frags. Subsequent dereferences of ip_hdr(skb)->daddr can read beyond the pulled
> linear buffer length.
> 
> Fix this by using pskb_network_may_pull(), which adds skb_network_offset(skb) to
> the length check to ensure the full network header is present in the linear buffer.
> 
> Fixes: e4f67addf158 ("add DOVE extensions for VXLAN")
> Cc: stable@vger.kernel.org
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> ---
>   drivers/net/vxlan/vxlan_core.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c
> index 10dd19eec09e266197ee51330a652f4e76c9643a..9ccbebda860480f8378918ff360deee1c46f3f7d 100644
> --- a/drivers/net/vxlan/vxlan_core.c
> +++ b/drivers/net/vxlan/vxlan_core.c
> @@ -2111,7 +2111,7 @@ static bool route_shortcircuit(struct net_device *dev, struct sk_buff *skb)
>   	{
>   		struct iphdr *pip;
>   
> -		if (!pskb_may_pull(skb, sizeof(struct iphdr)))
> +		if (!pskb_network_may_pull(skb, sizeof(struct iphdr)))
>   			return false;
>   		pip = ip_hdr(skb);
>   		n = neigh_lookup(&arp_tbl, &pip->daddr, dev);
> @@ -2137,7 +2137,7 @@ static bool route_shortcircuit(struct net_device *dev, struct sk_buff *skb)
>   		 */
>   		if (!ipv6_mod_enabled())
>   			return false;
> -		if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
> +		if (!pskb_network_may_pull(skb, sizeof(struct ipv6hdr)))
>   			return false;
>   		pip6 = ipv6_hdr(skb);
>   		n = neigh_lookup(&nd_tbl, &pip6->daddr, dev);

Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>