Re: [PATCH net] vxlan: use one headroom snapshot for neighbour replies

[Paolo Abeni]

On 8/31/26 7:46 AM, Sanghyun Park wrote:
> vxlan_na_create() samples LL_RESERVED_SPACE() to size the reply skb and then
> samples it again to reserve headroom. A concurrent vxlan_changelink() can
> update needed_headroom between the two reads, creating a TOCTOU race. The
> second value can exceed the allocation and make the Ethernet header write out
> of bounds.
> 
> Snapshot the headroom once and use that value for both allocation and
> reservation.
> 
> Fixes: 4b29dba9c085 ("vxlan: fix nonfunctional neigh_reduce()")
> Signed-off-by: Sanghyun Park <sanghyun.park.cnu@xxxxxxxxx>
The patch LGTM, but the changelog needs some improvements: if you have
can observe a splat on the unpatched kernel, please include it,
otherwise please explain whythe issue is not just a theoretical one.
Also please specify if some LLM has been used.

Thanks,

Paolo