Re: [PATCH net v3] ipv6: reject routes without an inet6_dev

[Ido Schimmel <idosch@nvidia.com>]

On Mon, Nov 09, 2026 at 04:29:40PM +0800, Yingjie Wang wrote:
> ip6_route_output() and ip6_route_lookup() can return an error-free route
> whose rt6i_idev is NULL.  Lowering an external nexthop device's MTU below
> IPV6_MIN_MTU tears down its inet6_dev, while fib6_ifdown() leaves routes
> using nexthop objects in the FIB.
> 
> An unprivileged user with CAP_NET_ADMIN in a private user and network
> namespace can construct this state.  Consumers which treat a route without
> an error as usable can then dereference the NULL rt6i_idev.  This was
> reproduced as a KASAN NULL pointer dereference in ip6_tnl_xmit().
> 
> An audit of IPv6 route and tunnel users found this unchecked
> ip6_dst_idev() dereference.
> 
> A similar missing inet6_dev check was fixed in commit 1b9b5323725e
> ("netfilter: ip6t_rpfilter: reject routes without inet6_dev").  However,
> the route construction path still marks routes without an inet6_dev as
> successful, leaving every consumer responsible for the same check.
> 
> Acquire the inet6_dev reference before initializing the destination.  If a
> non-reject route has no inet6_dev, initialize it as RTN_UNREACHABLE instead
> of a successful route.  Explicit reject routes keep their original type and
> error.  This establishes that ordinary error-free IPv6 routes have an
> inet6_dev while retaining the existing defensive checks at callers.
> 
> The modified route object builds cleanly with W=1.  A full x86_64 KASAN
> bzImage build completes; it reports two pre-existing kernel-doc warnings
> outside this change.
> 
> Tests:
>   - `make W=1 net/ipv6/route.o`
>   - full x86_64 KASAN `bzImage` build with `W=1`
>   - KASAN QEMU with an unprivileged user and network namespace: after
>     lowering the MTU, the stale route returned `No route to host`, a normal
>     route still resolved, and the collect_md trigger completed without
>     KASAN, oops, or panic
>   - `tools/testing/selftests/net/ip6_tunnel.sh` in the same KASAN QEMU
> 
> Fixes: 5b98324ebe29 ("ipv6: Allow routes to use nexthop objects")
> Closes: https://lore.kernel.org/netdev/DMP4WRIOGMBX.3VW2KNLBGDZ0K@gmail.com/
> Suggested-by: Alexei Starovoitov <ast@kernel.org>
> Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>
> Cc: stable@vger.kernel.org
> Signed-off-by: Yingjie Wang <1075151112@qq.com>

It makes IPv6 consistent with IPv4 in that both now return an error when
hitting such a route [1]. The error code is different, but that's fine,
so:

Reviewed-by: Ido Schimmel <idosch@nvidia.com>

[1]
ip link add name dummy1 up type dummy
ip -4 nexthop add id 1 dev dummy1
ip -6 nexthop add id 2 dev dummy1
ip -4 route add 192.0.2.0/24 nhid 1
ip -6 route add 2001:db8:1::/64 nhid 2
ip link set dev dummy1 mtu 60
ip -4 route get 192.0.2.1
RTNETLINK answers: Invalid argument
ip -6 route get 2001:db8:1::1
RTNETLINK answers: No route to host