Re: [PATCH net v2] ipv6: reject routes without an inet6_dev

[Hangbin Liu <hangbin.liu@linux.dev>]

On Sun, Nov 08, 2026 at 03:09:36PM +0800, Yingjie Wang wrote:
> ip6_route_output() and ip6_route_lookup() can return an error-free route
> whose rt6i_idev is NULL.  Lowering an external nexthop device's MTU below
> IPV6_MIN_MTU tears down its inet6_dev, while fib6_ifdown() leaves routes
> using nexthop objects in the FIB.
> 
> An unprivileged user with CAP_NET_ADMIN in a private user and network
> namespace can construct this state.  Consumers which treat a route without
> an error as usable can then dereference the NULL rt6i_idev.  This was
> reproduced as a KASAN NULL pointer dereference in ip6_tnl_xmit().
> 
> A similar missing inet6_dev check was fixed in commit 1b9b5323725e
> ("netfilter: ip6t_rpfilter: reject routes without inet6_dev").  However,
> the route construction path still marks routes without an inet6_dev as
> successful, leaving every consumer responsible for the same check.
> 
> Acquire the inet6_dev reference before initializing the destination.  If a
> non-reject route has no inet6_dev, initialize it as RTN_UNREACHABLE instead
> of a successful route.  Explicit reject routes keep their original type and
> error.  This establishes that ordinary error-free IPv6 routes have an
> inet6_dev while retaining the existing defensive checks at callers.
> 
> The modified route object builds cleanly with W=1.  A full x86_64 KASAN
> bzImage build completes; it reports two pre-existing kernel-doc warnings
> outside this change.
> 
> Tests:
>   - `make W=1 net/ipv6/route.o`
>   - full x86_64 KASAN `bzImage` build with `W=1`
>   - KASAN QEMU with an unprivileged user and network namespace: after
>     lowering the MTU, the stale route returned `No route to host`, a normal
>     route still resolved, and the collect_md trigger completed without
>     KASAN, oops, or panic
>   - `tools/testing/selftests/net/ip6_tunnel.sh` in the same KASAN QEMU
> 
> Fixes: 5b98324ebe29 ("ipv6: Allow routes to use nexthop objects")
> Closes: https://lore.kernel.org/netdev/tencent_CB9E1044AC97882719FF3A9F5B410A562408@qq.com/
> Link: https://lore.kernel.org/netdev/DMP4WRIOGMBX.3VW2KNLBGDZ0K@gmail.com/

I think it should be

Closes: https://lore.kernel.org/netdev/DMP4WRIOGMBX.3VW2KNLBGDZ0K@gmail.com/

The Link tag usually added by the bot when maintainer apply your patch.

> Suggested-by: Alexei Starovoitov <ast@kernel.org>
> Cc: stable@vger.kernel.org
> Signed-off-by: Yingjie Wang <1075151112@qq.com>
> ---
> Changes since v1:
>   - Move the invariant into IPv6 route construction following Alexei
>     Starovoitov's review.
>   - Acquire `rt6i_idev` before destination initialization and preserve the
>     existing handling of explicit reject routes.
>   - Update `Fixes:` to the nexthop-object route support commit.
> 
> v1: https://lore.kernel.org/netdev/tencent_CB9E1044AC97882719FF3A9F5B410A562408@qq.com/
> 
>  net/ipv6/route.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
> 
> diff --git a/net/ipv6/route.c b/net/ipv6/route.c
> index 2eb884558c24..a4c792fc55e3 100644
> --- a/net/ipv6/route.c
> +++ b/net/ipv6/route.c
> @@ -1165,6 +1165,12 @@ static void ip6_rt_init_dst(struct rt6_info *rt, const struct fib6_result *res)
>  		return;
>  	}
>  
> +	/* addrconf_ifdown() removed inet6_dev. The device can't do IPv6. */
> +	if (!rt->rt6i_idev) {
> +		ip6_rt_init_dst_reject(rt, RTN_UNREACHABLE);
> +		return;
> +	}
> +
>  	rt->dst.error = 0;
>  	rt->dst.output = ip6_output;
>  
> @@ -1200,10 +1206,10 @@ static void ip6_rt_copy_init(struct rt6_info *rt, const struct fib6_result *res)
>  	const struct net_device *dev = nh->fib_nh_dev;
>  	struct fib6_info *f6i = res->f6i;
>  
> +	rt->rt6i_idev = dev ? in6_dev_get(dev) : NULL;
>  	ip6_rt_init_dst(rt, res);
>  
>  	rt->rt6i_dst = f6i->fib6_dst;
> -	rt->rt6i_idev = dev ? in6_dev_get(dev) : NULL;
>  	rt->rt6i_flags = res->fib6_flags;
>  	if (nh->fib_nh_gw_family) {
>  		rt->rt6i_gateway = nh->fib_nh_gw6;
> 
> base-commit: 30c71476d842b094651bd7712f6c8ee8716147d0
> -- 
> 2.43.0
> 

The change looks good to me.

Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>