[PATCH net-next 0/4] net/ipv6: RFC6724 rule 5.5 preparations

[PATCH net-next 0/4] net/ipv6: RFC6724 rule 5.5 preparations

[David Lamparter]

Hi all,

following 4 patches are preparations for RFC6724 (IPv6 source address
selection) rule 5.5, which says "prefer addresses announced by the
router you're using".  The changes here just pass down the route into
the source address selection code, it's not used for anything yet.
(Any change of behavior from these patches is a mistake on my end.)

Cheers,

David


David Lamparter (4):
  net/ipv6: flatten ip6_route_get_saddr
  net/ipv6: create ipv6_fl_get_saddr
  net/ipv6: use ipv6_fl_get_saddr in output
  net/ipv6: drop ip6_route_get_saddr

 include/net/addrconf.h  |  4 ++++
 include/net/ip6_route.h | 26 ------------------------
 net/ipv6/addrconf.c     | 45 +++++++++++++++++++++++++++++++----------
 net/ipv6/ip6_output.c   | 27 ++++++++++++++++++-------
 net/ipv6/route.c        | 16 ++++++++++++---
 5 files changed, 71 insertions(+), 47 deletions(-)

-- 
2.47.2

[PATCH net-next 1/4] net/ipv6: flatten ip6_route_get_saddr

[David Lamparter]

Inline ip6_route_get_saddr()'s functionality in rt6_fill_node(), to
prepare for replacing the former with a dst based function.

NB: the l3mdev handling introduced by 252442f2ae31 "ipv6: fix source
address selection with route leak" is dropped here - the l3mdev ifindex
was a constant 0 on this call site, so that code was in fact dead.

Signed-off-by: David Lamparter <equinox@diac24.net>
Cc: Lorenzo Colitti <lorenzo@google.com>
Cc: Patrick Rohr <prohr@google.com>
---
 net/ipv6/route.c | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 3fbe0885c21c..a2362913ebed 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -5821,9 +5821,19 @@ static int rt6_fill_node(struct net *net, struct sk_buff *skb,
 			if (nla_put_u32(skb, RTA_IIF, iif))
 				goto nla_put_failure;
 	} else if (dest) {
-		struct in6_addr saddr_buf;
-		if (ip6_route_get_saddr(net, rt, dest, 0, 0, &saddr_buf) == 0 &&
-		    nla_put_in6_addr(skb, RTA_PREFSRC, &saddr_buf))
+		struct in6_addr saddr_buf, *saddr = NULL;
+
+		if (rt->fib6_prefsrc.plen) {
+			saddr = &rt->fib6_prefsrc.addr;
+		} else {
+			struct net_device *dev = fib6_info_nh_dev(rt);
+
+			if (ipv6_dev_get_saddr(net, dev, dest, 0,
+					       &saddr_buf) == 0)
+				saddr = &saddr_buf;
+		}
+
+		if (saddr && nla_put_in6_addr(skb, RTA_PREFSRC, saddr))
 			goto nla_put_failure;
 	}
 
-- 
2.47.2

[PATCH net-next 2/4] net/ipv6: create ipv6_fl_get_saddr

[David Lamparter]

This adds passing the relevant flow information as well as selected
nexthop into the source address selection code, to allow the RFC6724
rule 5.5 code to look at its details.

Signed-off-by: David Lamparter <equinox@diac24.net>
Cc: Lorenzo Colitti <lorenzo@google.com>
Cc: Patrick Rohr <prohr@google.com>
---
 include/net/addrconf.h |  4 ++++
 net/ipv6/addrconf.c    | 45 +++++++++++++++++++++++++++++++-----------
 2 files changed, 38 insertions(+), 11 deletions(-)

diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index 9e5e95988b9e..952395c198f9 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -141,6 +141,10 @@ struct inet6_ifaddr *ipv6_get_ifaddr(struct net *net,
 int ipv6_dev_get_saddr(struct net *net, const struct net_device *dev,
 		       const struct in6_addr *daddr, unsigned int srcprefs,
 		       struct in6_addr *saddr);
+int ipv6_fl_get_saddr(struct net *net, const struct dst_entry *dst,
+		      const struct net_device *dst_dev,
+		      const struct sock *sk, unsigned int srcprefs,
+		      struct flowi6 *fl6);
 int ipv6_get_lladdr(struct net_device *dev, struct in6_addr *addr,
 		    u32 banned_flags);
 bool inet_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2,
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 4f1d7d110302..8ff3aad71466 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1528,7 +1528,9 @@ struct ipv6_saddr_score {
 };
 
 struct ipv6_saddr_dst {
-	const struct in6_addr *addr;
+	const struct flowi6 *fl6;
+	const struct dst_entry *dst;
+	const struct sock *sk;
 	int ifindex;
 	int scope;
 	int label;
@@ -1605,7 +1607,7 @@ static int ipv6_get_saddr_eval(struct net *net,
 		break;
 	case IPV6_SADDR_RULE_LOCAL:
 		/* Rule 1: Prefer same address */
-		ret = ipv6_addr_equal(&score->ifa->addr, dst->addr);
+		ret = ipv6_addr_equal(&score->ifa->addr, &dst->fl6->daddr);
 		break;
 	case IPV6_SADDR_RULE_SCOPE:
 		/* Rule 2: Prefer appropriate scope
@@ -1683,11 +1685,11 @@ static int ipv6_get_saddr_eval(struct net *net,
 		 *	    non-ORCHID vs non-ORCHID
 		 */
 		ret = !(ipv6_addr_orchid(&score->ifa->addr) ^
-			ipv6_addr_orchid(dst->addr));
+			ipv6_addr_orchid(&dst->fl6->daddr));
 		break;
 	case IPV6_SADDR_RULE_PREFIX:
 		/* Rule 8: Use longest matching prefix */
-		ret = ipv6_addr_diff(&score->ifa->addr, dst->addr);
+		ret = ipv6_addr_diff(&score->ifa->addr, &dst->fl6->daddr);
 		if (ret > score->ifa->prefix_len)
 			ret = score->ifa->prefix_len;
 		score->matchlen = ret;
@@ -1805,9 +1807,10 @@ static int ipv6_get_saddr_master(struct net *net,
 	return hiscore_idx;
 }
 
-int ipv6_dev_get_saddr(struct net *net, const struct net_device *dst_dev,
-		       const struct in6_addr *daddr, unsigned int prefs,
-		       struct in6_addr *saddr)
+int ipv6_fl_get_saddr(struct net *net, const struct dst_entry *dst_entry,
+		      const struct net_device *dst_dev,
+		      const struct sock *sk, unsigned int prefs,
+		      struct flowi6 *fl6)
 {
 	struct ipv6_saddr_score scores[2], *hiscore;
 	struct ipv6_saddr_dst dst;
@@ -1818,11 +1821,13 @@ int ipv6_dev_get_saddr(struct net *net, const struct net_device *dst_dev,
 	int hiscore_idx = 0;
 	int ret = 0;
 
-	dst_type = __ipv6_addr_type(daddr);
-	dst.addr = daddr;
+	dst_type = __ipv6_addr_type(&fl6->daddr);
+	dst.fl6 = fl6;
+	dst.sk = sk;
+	dst.dst = dst_entry;
 	dst.ifindex = dst_dev ? dst_dev->ifindex : 0;
 	dst.scope = __ipv6_addr_src_scope(dst_type);
-	dst.label = ipv6_addr_label(net, daddr, dst_type, dst.ifindex);
+	dst.label = ipv6_addr_label(net, &fl6->daddr, dst_type, dst.ifindex);
 	dst.prefs = prefs;
 
 	scores[hiscore_idx].rule = -1;
@@ -1897,11 +1902,29 @@ int ipv6_dev_get_saddr(struct net *net, const struct net_device *dst_dev,
 	if (!hiscore->ifa)
 		ret = -EADDRNOTAVAIL;
 	else
-		*saddr = hiscore->ifa->addr;
+		fl6->saddr = hiscore->ifa->addr;
 
 	rcu_read_unlock();
 	return ret;
 }
+EXPORT_SYMBOL(ipv6_fl_get_saddr);
+
+int ipv6_dev_get_saddr(struct net *net, const struct net_device *dst_dev,
+		       const struct in6_addr *daddr, unsigned int prefs,
+		       struct in6_addr *saddr)
+{
+	struct flowi6 fl6;
+	int ret;
+
+	memset(&fl6, 0, sizeof(fl6));
+	fl6.daddr = *daddr;
+
+	ret = ipv6_fl_get_saddr(net, NULL, dst_dev, NULL, prefs, &fl6);
+	if (!ret)
+		*saddr = fl6.saddr;
+
+	return ret;
+}
 EXPORT_SYMBOL(ipv6_dev_get_saddr);
 
 static int __ipv6_get_lladdr(struct inet6_dev *idev, struct in6_addr *addr,
-- 
2.47.2

[PATCH net-next 3/4] net/ipv6: use ipv6_fl_get_saddr in output

[David Lamparter]

Flatten ip6_route_get_saddr() into ip6_dst_lookup_tail (which really
just means handling fib6_prefsrc), and then replace ipv6_dev_get_saddr
with ipv6_fl_get_saddr to pass down the flow information.

Signed-off-by: David Lamparter <equinox@diac24.net>
Cc: Lorenzo Colitti <lorenzo@google.com>
Cc: Patrick Rohr <prohr@google.com>
---
 net/ipv6/ip6_output.c | 27 ++++++++++++++++++++-------
 1 file changed, 20 insertions(+), 7 deletions(-)

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 0412f8544695..eeda556f275f 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1111,31 +1111,44 @@ static int ip6_dst_lookup_tail(struct net *net, const struct sock *sk,
 	struct neighbour *n;
 	struct rt6_info *rt;
 #endif
-	int err;
+	int err = 0;
 	int flags = 0;
 
 	/* The correct way to handle this would be to do
-	 * ip6_route_get_saddr, and then ip6_route_output; however,
+	 * ipv6_fl_get_saddr, and then ip6_route_output; however,
 	 * the route-specific preferred source forces the
-	 * ip6_route_output call _before_ ip6_route_get_saddr.
+	 * ip6_route_output call _before_ ipv6_fl_get_saddr.
 	 *
 	 * In source specific routing (no src=any default route),
 	 * ip6_route_output will fail given src=any saddr, though, so
 	 * that's why we try it again later.
 	 */
 	if (ipv6_addr_any(&fl6->saddr)) {
+		struct net_device *l3mdev;
+		struct net_device *dev;
 		struct fib6_info *from;
 		struct rt6_info *rt;
+		bool same_vrf;
+		int err = 0;
 
 		*dst = ip6_route_output(net, sk, fl6);
 		rt = (*dst)->error ? NULL : dst_rt6_info(*dst);
 
 		rcu_read_lock();
 		from = rt ? rcu_dereference(rt->from) : NULL;
-		err = ip6_route_get_saddr(net, from, &fl6->daddr,
-					  sk ? READ_ONCE(inet6_sk(sk)->srcprefs) : 0,
-					  fl6->flowi6_l3mdev,
-					  &fl6->saddr);
+
+		l3mdev = dev_get_by_index_rcu(net, fl6->flowi6_l3mdev);
+		if (!from || !from->fib6_prefsrc.plen || l3mdev)
+			dev = from ? fib6_info_nh_dev(from) : NULL;
+		same_vrf = !l3mdev || l3mdev_master_dev_rcu(dev) == l3mdev;
+		if (from && from->fib6_prefsrc.plen && same_vrf)
+			fl6->saddr = from->fib6_prefsrc.addr;
+		else
+			err = ipv6_fl_get_saddr(net, *dst,
+						same_vrf ? dev : l3mdev, sk,
+						sk ? READ_ONCE(inet6_sk(sk)->srcprefs) : 0,
+						fl6);
+
 		rcu_read_unlock();
 
 		if (err)
-- 
2.47.2

[PATCH net-next 4/4] net/ipv6: drop ip6_route_get_saddr

[David Lamparter]

It's no longer used anywhere.

Signed-off-by: David Lamparter <equinox@diac24.net>
Cc: Lorenzo Colitti <lorenzo@google.com>
Cc: Patrick Rohr <prohr@google.com>
---
 include/net/ip6_route.h | 26 --------------------------
 1 file changed, 26 deletions(-)

diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index 9255f21818ee..6c52cabedbf6 100644
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -125,32 +125,6 @@ void rt6_flush_exceptions(struct fib6_info *f6i);
 void rt6_age_exceptions(struct fib6_info *f6i, struct fib6_gc_args *gc_args,
 			unsigned long now);
 
-static inline int ip6_route_get_saddr(struct net *net, struct fib6_info *f6i,
-				      const struct in6_addr *daddr,
-				      unsigned int prefs, int l3mdev_index,
-				      struct in6_addr *saddr)
-{
-	struct net_device *l3mdev;
-	struct net_device *dev;
-	bool same_vrf;
-	int err = 0;
-
-	rcu_read_lock();
-
-	l3mdev = dev_get_by_index_rcu(net, l3mdev_index);
-	if (!f6i || !f6i->fib6_prefsrc.plen || l3mdev)
-		dev = f6i ? fib6_info_nh_dev(f6i) : NULL;
-	same_vrf = !l3mdev || l3mdev_master_dev_rcu(dev) == l3mdev;
-	if (f6i && f6i->fib6_prefsrc.plen && same_vrf)
-		*saddr = f6i->fib6_prefsrc.addr;
-	else
-		err = ipv6_dev_get_saddr(net, same_vrf ? dev : l3mdev, daddr, prefs, saddr);
-
-	rcu_read_unlock();
-
-	return err;
-}
-
 struct rt6_info *rt6_lookup(struct net *net, const struct in6_addr *daddr,
 			    const struct in6_addr *saddr, int oif,
 			    const struct sk_buff *skb, int flags);
-- 
2.47.2

Re: [PATCH net-next 3/4] net/ipv6: use ipv6_fl_get_saddr in output

[David Lamparter]

Of course I find a mistake half an hour after sending it out...

On Thu, Jul 24, 2025 at 03:18:24PM +0200, David Lamparter wrote:
> @@ -1111,31 +1111,44 @@ static int ip6_dst_lookup_tail(struct net *net, const struct sock *sk,
>  	struct neighbour *n;
>  	struct rt6_info *rt;
>  #endif
> -	int err;
> +	int err = 0;
>  	int flags = 0;
[...]
>  		struct rt6_info *rt;
> +		bool same_vrf;
> +		int err = 0;

I accidentally introduced a second, shadow copy of "err"...

*sigh* should've built with W=2 so I get -Wshadow

...fixing and resending.


-David

[syzbot ci] Re: net/ipv6: RFC6724 rule 5.5 preparations

[syzbot ci]

syzbot ci has tested the following series

[v1] net/ipv6: RFC6724 rule 5.5 preparations
https://lore.kernel.org/all/20250724131828.32155-1-equinox@diac24.net
* [PATCH net-next 1/4] net/ipv6: flatten ip6_route_get_saddr
* [PATCH net-next 2/4] net/ipv6: create ipv6_fl_get_saddr
* [PATCH net-next 3/4] net/ipv6: use ipv6_fl_get_saddr in output
* [PATCH net-next 4/4] net/ipv6: drop ip6_route_get_saddr

and found the following issues:
* general protection fault in icmpv6_route_lookup
* general protection fault in xfrm_lookup_with_ifid

Full report is available here:
https://ci.syzbot.org/series/3acce8b8-a246-47fc-bb73-d961e3946a5c

***

general protection fault in icmpv6_route_lookup

tree:      net-next
URL:       https://kernel.googlesource.com/pub/scm/linux/kernel/git/netdev/net-next.git
base:      56613001dfc9b2e35e2d6ba857cbc2eb0bac4272
arch:      amd64
compiler:  Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
config:    https://ci.syzbot.org/builds/9e473f74-1396-464d-868c-c8273cf3923b/config
syz repro: https://ci.syzbot.org/findings/2c2d1023-a44b-4226-b918-23466b921da9/syz_repro

Oops: general protection fault, probably for non-canonical address 0xdffffc000000001c: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x00000000000000e0-0x00000000000000e7]
CPU: 0 UID: 0 PID: 5991 Comm: syz.0.19 Not tainted 6.16.0-rc6-syzkaller-01646-g56613001dfc9-dirty #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
RIP: 0010:ipv6_anycast_destination include/net/ip6_route.h:234 [inline]
RIP: 0010:icmpv6_route_lookup+0x1ad/0x590 net/ipv6/icmp.c:374
Code: a4 01 00 00 49 89 c7 e8 b1 54 94 f7 4c 89 f8 49 89 df e9 3f 02 00 00 4c 8b 74 24 60 4d 8d ae e0 00 00 00 4c 89 e8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 0f 85 41 03 00 00 45 8b 6d 00 44 89 ee 81 e6
RSP: 0018:ffffc90002b4ec00 EFLAGS: 00010202
RAX: 000000000000001c RBX: ffffc90002b4eee0 RCX: 0000000000000000
RDX: ffff8880206c3980 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90002b4ed70 R08: ffff88802a9ef3c3 R09: 1ffff1100553de78
R10: dffffc0000000000 R11: ffffed100553de79 R12: ffff88810de0f800
R13: 00000000000000e0 R14: 0000000000000000 R15: dffffc0000000000
FS:  00007faf43ec86c0(0000) GS:ffff8880b8615000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000034000 CR3: 0000000028440000 CR4: 00000000000006f0
Call Trace:
 <TASK>
 icmp6_send+0x1001/0x1940 net/ipv6/icmp.c:606
 icmpv6_param_prob_reason+0x32/0x50 net/ipv6/icmp.c:654
 ip6_tlvopt_unknown net/ipv6/exthdrs.c:94 [inline]
 ip6_parse_tlv+0x19fc/0x1e60 net/ipv6/exthdrs.c:-1
 ipv6_destopt_rcv+0x597/0xbc0 net/ipv6/exthdrs.c:325
 ip6_protocol_deliver_rcu+0xe0b/0x15c0 net/ipv6/ip6_input.c:438
 ip6_input_finish+0x191/0x370 net/ipv6/ip6_input.c:489
 NF_HOOK+0x30c/0x3a0 include/linux/netfilter.h:317
 ip6_input+0x16a/0x270 net/ipv6/ip6_input.c:500
 ip6_mc_input+0x5c8/0xaf0 net/ipv6/ip6_input.c:590
 NF_HOOK+0x30c/0x3a0 include/linux/netfilter.h:317
 __netif_receive_skb_one_core net/core/dev.c:5979 [inline]
 __netif_receive_skb+0xd3/0x380 net/core/dev.c:6092
 netif_receive_skb_internal net/core/dev.c:6178 [inline]
 netif_receive_skb+0x1cb/0x790 net/core/dev.c:6237
 tun_rx_batched+0x1b9/0x730 drivers/net/tun.c:1485
 tun_get_user+0x2aa2/0x3e20 drivers/net/tun.c:1950
 tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1996
 new_sync_write fs/read_write.c:593 [inline]
 vfs_write+0x54b/0xa90 fs/read_write.c:686
 ksys_write+0x145/0x250 fs/read_write.c:738
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7faf42f8e9a9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007faf43ec8038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007faf431b5fa0 RCX: 00007faf42f8e9a9
RDX: 0000000000000ffe RSI: 00002000000000c0 RDI: 0000000000000003
RBP: 00007faf43010d69 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007faf431b5fa0 R15: 00007ffeead38248
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:ipv6_anycast_destination include/net/ip6_route.h:234 [inline]
RIP: 0010:icmpv6_route_lookup+0x1ad/0x590 net/ipv6/icmp.c:374
Code: a4 01 00 00 49 89 c7 e8 b1 54 94 f7 4c 89 f8 49 89 df e9 3f 02 00 00 4c 8b 74 24 60 4d 8d ae e0 00 00 00 4c 89 e8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 0f 85 41 03 00 00 45 8b 6d 00 44 89 ee 81 e6
RSP: 0018:ffffc90002b4ec00 EFLAGS: 00010202
RAX: 000000000000001c RBX: ffffc90002b4eee0 RCX: 0000000000000000
RDX: ffff8880206c3980 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90002b4ed70 R08: ffff88802a9ef3c3 R09: 1ffff1100553de78
R10: dffffc0000000000 R11: ffffed100553de79 R12: ffff88810de0f800
R13: 00000000000000e0 R14: 0000000000000000 R15: dffffc0000000000
FS:  00007faf43ec86c0(0000) GS:ffff8880b8615000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000034000 CR3: 0000000028440000 CR4: 00000000000006f0
----------------
Code disassembly (best guess), 2 bytes skipped:
   0:	00 00                	add    %al,(%rax)
   2:	49 89 c7             	mov    %rax,%r15
   5:	e8 b1 54 94 f7       	call   0xf79454bb
   a:	4c 89 f8             	mov    %r15,%rax
   d:	49 89 df             	mov    %rbx,%r15
  10:	e9 3f 02 00 00       	jmp    0x254
  15:	4c 8b 74 24 60       	mov    0x60(%rsp),%r14
  1a:	4d 8d ae e0 00 00 00 	lea    0xe0(%r14),%r13
  21:	4c 89 e8             	mov    %r13,%rax
  24:	48 c1 e8 03          	shr    $0x3,%rax
* 28:	42 0f b6 04 38       	movzbl (%rax,%r15,1),%eax <-- trapping instruction
  2d:	84 c0                	test   %al,%al
  2f:	0f 85 41 03 00 00    	jne    0x376
  35:	45 8b 6d 00          	mov    0x0(%r13),%r13d
  39:	44 89 ee             	mov    %r13d,%esi
  3c:	81                   	.byte 0x81
  3d:	e6                   	.byte 0xe6


***

general protection fault in xfrm_lookup_with_ifid

tree:      net-next
URL:       https://kernel.googlesource.com/pub/scm/linux/kernel/git/netdev/net-next.git
base:      56613001dfc9b2e35e2d6ba857cbc2eb0bac4272
arch:      amd64
compiler:  Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
config:    https://ci.syzbot.org/builds/9e473f74-1396-464d-868c-c8273cf3923b/config
syz repro: https://ci.syzbot.org/findings/47a724ea-a36c-478d-af91-ca8b35320f01/syz_repro

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 0 UID: 0 PID: 6016 Comm: syz.1.17 Not tainted 6.16.0-rc6-syzkaller-01646-g56613001dfc9-dirty #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
RIP: 0010:xfrm_lookup_with_ifid+0xb9/0x1a70 net/xfrm/xfrm_policy.c:3181
Code: c7 44 29 0a f3 f3 e8 f6 b8 ac f7 ba 10 00 00 00 4c 89 f7 31 f6 e8 d7 ca 0e f8 4c 89 64 24 18 49 83 c4 08 4c 89 e0 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 e7 e8 e8 c7 0e f8 4d 8b 24 24 4c 89 e0
RSP: 0018:ffffc90002b77960 EFLAGS: 00010202
RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc90002b77a10
RBP: ffffc90002b77a78 R08: ffffc90002b77a0f R09: 0000000000000000
R10: ffffc90002b77a00 R11: fffff5200056ef42 R12: 0000000000000008
R13: dffffc0000000000 R14: ffffc90002b77a00 R15: ffff888025d85d80
FS:  00007fa26dbba6c0(0000) GS:ffff8880b8615000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000000000 CR3: 0000000026e50000 CR4: 00000000000006f0
Call Trace:
 <TASK>
 xfrm_lookup net/xfrm/xfrm_policy.c:3336 [inline]
 xfrm_lookup_route+0x3c/0x1c0 net/xfrm/xfrm_policy.c:3347
 ip6_datagram_dst_update+0x75c/0xcb0 net/ipv6/datagram.c:96
 __ip6_datagram_connect+0xbd1/0x1150 net/ipv6/datagram.c:255
 udpv6_connect+0x36/0x240 net/ipv6/udp.c:1310
 __sys_connect_file net/socket.c:2086 [inline]
 __sys_connect+0x316/0x440 net/socket.c:2105
 __do_sys_connect net/socket.c:2111 [inline]
 __se_sys_connect net/socket.c:2108 [inline]
 __x64_sys_connect+0x7a/0x90 net/socket.c:2108
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa26cd8e9a9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fa26dbba038 EFLAGS: 00000246 ORIG_RAX: 000000000000002a
RAX: ffffffffffffffda RBX: 00007fa26cfb5fa0 RCX: 00007fa26cd8e9a9
RDX: 000000000000001c RSI: 0000200000000000 RDI: 0000000000000003
RBP: 00007fa26ce10d69 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fa26cfb5fa0 R15: 00007ffe87554b78
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:xfrm_lookup_with_ifid+0xb9/0x1a70 net/xfrm/xfrm_policy.c:3181
Code: c7 44 29 0a f3 f3 e8 f6 b8 ac f7 ba 10 00 00 00 4c 89 f7 31 f6 e8 d7 ca 0e f8 4c 89 64 24 18 49 83 c4 08 4c 89 e0 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 e7 e8 e8 c7 0e f8 4d 8b 24 24 4c 89 e0
RSP: 0018:ffffc90002b77960 EFLAGS: 00010202
RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc90002b77a10
RBP: ffffc90002b77a78 R08: ffffc90002b77a0f R09: 0000000000000000
R10: ffffc90002b77a00 R11: fffff5200056ef42 R12: 0000000000000008
R13: dffffc0000000000 R14: ffffc90002b77a00 R15: ffff888025d85d80
FS:  00007fa26dbba6c0(0000) GS:ffff8880b8615000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000000000 CR3: 0000000026e50000 CR4: 00000000000006f0
----------------
Code disassembly (best guess):
   0:	c7 44 29 0a f3 f3 e8 	movl   $0xf6e8f3f3,0xa(%rcx,%rbp,1)
   7:	f6
   8:	b8 ac f7 ba 10       	mov    $0x10baf7ac,%eax
   d:	00 00                	add    %al,(%rax)
   f:	00 4c 89 f7          	add    %cl,-0x9(%rcx,%rcx,4)
  13:	31 f6                	xor    %esi,%esi
  15:	e8 d7 ca 0e f8       	call   0xf80ecaf1
  1a:	4c 89 64 24 18       	mov    %r12,0x18(%rsp)
  1f:	49 83 c4 08          	add    $0x8,%r12
  23:	4c 89 e0             	mov    %r12,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	42 80 3c 28 00       	cmpb   $0x0,(%rax,%r13,1) <-- trapping instruction
  2f:	74 08                	je     0x39
  31:	4c 89 e7             	mov    %r12,%rdi
  34:	e8 e8 c7 0e f8       	call   0xf80ec821
  39:	4d 8b 24 24          	mov    (%r12),%r12
  3d:	4c 89 e0             	mov    %r12,%rax


***

If these findings have caused you to resend the series or submit a
separate fix, please add the following tag to your commit message:
Tested-by: syzbot@syzkaller.appspotmail.com

---
This report is generated by a bot. It may contain errors.
syzbot ci engineers can be reached at syzkaller@googlegroups.com.