Re: [PATCH net v2] vxlan: reject adding a remote to a nexthop fdb entry

[Ido Schimmel]

On Tue, Oct 20, 2026 at 11:45:31AM +0800, Henry Martin wrote:
> FDB entries backed by a nexthop group must not carry a remote
> destination list.  vxlan_fdb_update_existing() currently appends a
> remote via vxlan_fdb_append() on an NLM_F_APPEND request with a
> multicast or zero MAC even when the entry is backed by a nexthop,
> breaking that invariant through three different callers:
> 
> - "bridge fdb append" with a dst on a nexthop entry;
> - "ip link set dev vx0 type vxlan remote <ip>" (vxlan_changelink());
> - "bridge vni add/change ... group <mcast>" on a vnifilter device
>   (vxlan_update_default_fdb_entry()).
> 
> All three reach the append block with nhid == 0 and a PERMANENT
> state, so they pass the earlier nexthop checks.
> 
> Reject the combination at the top of vxlan_fdb_update_existing(),
> next to the existing nexthop guards, so a refused request has no
> side effects: placing the check in the append block instead would
> return -EOPNOTSUPP only after the entry state and flags have been
> rewritten, skipping both the notification pass and the err_notify
> rollback.
> 
> Note the resulting behavior change for the two rtnetlink callers:
> operations that previously succeeded while silently attaching an
> unused remote to a nexthop entry now fail with extack
> "Cannot add a remote to a nexthop fdb entry".
> 
> This issue was discovered by Tencent CodeBuddy Security.
> 
> Cc: stable@xxxxxxxxxxxxxxx
> Fixes: 1274e1cc4226 ("vxlan: ecmp support for mac fdb entries")
> Signed-off-by: Henry Martin <bsdhenrymartin@xxxxxxxxx>

I agree that it doesn't make sense to append a remote to an FDB entry
that points to a nexthop, but what are the consequences of allowing it?
Does this patch fix a crash / memory leak? If so, the commit message
should describe it. Otherwise, this looks like net-next material
(currently closed).

Also, please add a test case in fib_nexthops.sh, in a similar fashion to
commit 98fc57d16744 ("vxlan: reject dynamic fdb entries that reference a
nexthop id").