Re: [PATCH bpf-next v4 2/6] net: move netfilter nf_reject6_fill_skb_dst to core ipv6

[sashiko-bot@kernel.org]

Sashiko AI review found 2 potential issue(s):
- [High] Unchecked access to `skb->dev` causes a NULL pointer dereference kernel panic.
- [High] Dereferencing `ipv6_hdr(skb)->saddr` without prior linearization checks leads to out-of-bounds reads or page faults.
--

commit 71316e9661f6289f37134f91e40b833968dfa0d5
Author: Mahe Tardy <mahe.tardy@gmail.com>

net: move netfilter nf_reject6_fill_skb_dst to core ipv6

This commit moves and renames nf_reject6_fill_skb_dst to
ip6_route_reply_fetch_dst in ipv6/route.c. This allows the function
to be reused in subsequent patches by BPF kfuncs.

[ ... ]

> diff --git a/net/ipv6/route.c b/net/ipv6/route.c
> index 19eb6b7022278..41871fddec4d6 100644
> --- a/net/ipv6/route.c
> +++ b/net/ipv6/route.c

[ ... ]

> @@ -2721,6 +2721,24 @@ struct dst_entry *ip6_route_output_flags(struct net *net,
>  }
>  EXPORT_SYMBOL_GPL(ip6_route_output_flags);
>  
> +int ip6_route_reply_fetch_dst(struct sk_buff *skb)
> +{
> +	struct dst_entry *result;
> +	struct flowi6 fl = {
> +		.daddr = ipv6_hdr(skb)->saddr

Is it possible for the IPv6 header to span paged fragments here?

If the packet header isn't guaranteed to be in the linear data area, and
there are no linearization checks like pskb_may_pull() before accessing
ipv6_hdr(), could this read out-of-bounds memory or cause a page fault
when processing undersized or fragmented packets supplied by BPF programs?

> +	};
> +	int err;
> +
> +	result = ip6_route_output(dev_net(skb->dev), NULL, &fl);

Could skb->dev be NULL in contexts where this function will be used?

Since this is being exported for use by BPF kfuncs, it might be called from
program types where the device reference is not retained, such as socket
filters. If skb->dev is NULL in these contexts, won't dev_net(skb->dev)
cause a NULL pointer dereference?

> +	err = result->error;
> +	if (err)
> +		dst_release(result);
> +	else
> +		skb_dst_set(skb, result);
> +	return err;
> +}
> +EXPORT_SYMBOL_GPL(ip6_route_reply_fetch_dst);

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260420105816.72168-1-mahe.tardy@gmail.com?part=2