[PATCH net v3 0/3] {net,bpf}: nd_tbl fixes for when ipv6.disable=1

[PATCH net v3 0/3] {net,bpf}: nd_tbl fixes for when ipv6.disable=1

[Ricardo B. Marlière]

Signed-off-by: Ricardo B. Marlière <rbm@suse.com>
---
Changes in v3:
- Don't use ipv6_mod_enabled() in net/core/filter.c.
- Link to v2: https://lore.kernel.org/r/20260305-net-nd_tbl_fixes-v2-0-b7177db1a9f3@suse.com

Changes in v2:
- Used ipv6_mod_enabled() helper, guarded by unlikely().
- Link to v1: https://lore.kernel.org/r/20260228-net-nd_tbl_fixes-v1-0-2b2a274df9bb@suse.com

---
Ricardo B. Marlière (3):
      bpf: bpf_out_neigh_v4: Fix nd_tbl NULL dereference when IPv6 is disabled
      bpf: bpf_out_neigh_v6: Fix nd_tbl NULL dereference when IPv6 is disabled
      net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled

 drivers/net/bonding/bond_main.c | 3 +++
 net/core/filter.c               | 7 +++++++
 2 files changed, 10 insertions(+)
---
base-commit: b824c3e16c1904bf80df489e293d1e3cbf98896d
change-id: 20260228-net-nd_tbl_fixes-ce81ca1e0bf2

Best regards,
-- 
Ricardo B. Marlière <rbm@suse.com>

[PATCH net v3 1/3] bpf: bpf_out_neigh_v4: Fix nd_tbl NULL dereference when IPv6 is disabled

[Ricardo B. Marlière]

When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never
initialized because inet6_init() exits before ndisc_init() is called which
initializes it. If bpf_redirect_neigh() is called from tc with an explicit
nexthop of nh_family == AF_INET6, bpf_out_neigh_v4() takes the AF_INET6
branch and calls ip_neigh_gw6(), which relies on ipv6_stub->nd_tbl.

 BUG: kernel NULL pointer dereference, address: 0000000000000248
 Oops: Oops: 0000 [#1] SMP NOPTI
 RIP: 0010:skb_do_redirect+0xb93/0xf00
 Call Trace:
  <TASK>
  ? srso_alias_return_thunk+0x5/0xfbef5
  ? __tcf_classify.constprop.0+0x83/0x160
  ? srso_alias_return_thunk+0x5/0xfbef5
  ? tcf_classify+0x2b/0x50
  ? srso_alias_return_thunk+0x5/0xfbef5
  ? tc_run+0xb8/0x120
  ? srso_alias_return_thunk+0x5/0xfbef5
  __dev_queue_xmit+0x6fa/0x1000
  ? srso_alias_return_thunk+0x5/0xfbef5
  ? srso_alias_return_thunk+0x5/0xfbef5
  ? alloc_skb_with_frags+0x58/0x200
  packet_sendmsg+0x10da/0x1700
  ? srso_alias_return_thunk+0x5/0xfbef5
  __sys_sendto+0x1f3/0x220
  __x64_sys_sendto+0x24/0x30
  do_syscall_64+0x101/0xf80
  ? exc_page_fault+0x6e/0x170
  ? srso_alias_return_thunk+0x5/0xfbef5
  entry_SYSCALL_64_after_hwframe+0x77/0x7f
  </TASK>

Fix this by adding an early check in the AF_INET6 branch of
bpf_out_neigh_v4(). If ipv6_stub->nd_tbl is NULL, unlock RCU and drop the
packet.

Suggested-by: Fernando Fernandez Mancera <fmancera@suse.de>
Fixes: ba452c9e996d ("bpf: Fix bpf_redirect_neigh helper api to support supplying nexthop")
Signed-off-by: Ricardo B. Marlière <rbm@suse.com>
---
 net/core/filter.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/core/filter.c b/net/core/filter.c
index 0d5d5a17acb2..4f8ff05c4ec4 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2335,6 +2335,10 @@ static int bpf_out_neigh_v4(struct net *net, struct sk_buff *skb,
 
 		neigh = ip_neigh_for_gw(rt, skb, &is_v6gw);
 	} else if (nh->nh_family == AF_INET6) {
+		if (unlikely(!ipv6_stub->nd_tbl)) {
+			rcu_read_unlock();
+			goto out_drop;
+		}
 		neigh = ip_neigh_gw6(dev, &nh->ipv6_nh);
 		is_v6gw = true;
 	} else if (nh->nh_family == AF_INET) {

-- 
2.53.0

[PATCH net v3 2/3] bpf: bpf_out_neigh_v6: Fix nd_tbl NULL dereference when IPv6 is disabled

[Ricardo B. Marlière]

When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never
initialized because inet6_init() exits before ndisc_init() is called which
initializes it. If bpf_redirect_neigh() is called with explicit AF_INET6
nexthop parameters, __bpf_redirect_neigh_v6() can skip the IPv6 FIB lookup
and call bpf_out_neigh_v6() directly. bpf_out_neigh_v6() then calls
ip_neigh_gw6(), which uses ipv6_stub->nd_tbl.

 BUG: kernel NULL pointer dereference, address: 0000000000000248
 Oops: Oops: 0000 [#1] SMP NOPTI
 RIP: 0010:skb_do_redirect+0x44f/0xf40
 Call Trace:
  <TASK>
  ? srso_alias_return_thunk+0x5/0xfbef5
  ? __tcf_classify.constprop.0+0x83/0x160
  ? srso_alias_return_thunk+0x5/0xfbef5
  ? tcf_classify+0x2b/0x50
  ? srso_alias_return_thunk+0x5/0xfbef5
  ? tc_run+0xb8/0x120
  ? srso_alias_return_thunk+0x5/0xfbef5
  __dev_queue_xmit+0x6fa/0x1000
  ? srso_alias_return_thunk+0x5/0xfbef5
  packet_sendmsg+0x10da/0x1700
  ? srso_alias_return_thunk+0x5/0xfbef5
  __sys_sendto+0x1f3/0x220
  __x64_sys_sendto+0x24/0x30
  do_syscall_64+0x101/0xf80
  ? exc_page_fault+0x6e/0x170
  ? srso_alias_return_thunk+0x5/0xfbef5
  entry_SYSCALL_64_after_hwframe+0x77/0x7f
  </TASK>

Fix this by adding an early check in bpf_out_neigh_v6(). If
ipv6_stub->nd_tbl is NULL, drop the packet before neighbor lookup.

Suggested-by: Fernando Fernandez Mancera <fmancera@suse.de>
Fixes: ba452c9e996d ("bpf: Fix bpf_redirect_neigh helper api to support supplying nexthop")
Signed-off-by: Ricardo B. Marlière <rbm@suse.com>
---
 net/core/filter.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/core/filter.c b/net/core/filter.c
index 4f8ff05c4ec4..3be669347e62 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2228,6 +2228,9 @@ static int bpf_out_neigh_v6(struct net *net, struct sk_buff *skb,
 			return -ENOMEM;
 	}
 
+	if (unlikely(!ipv6_stub->nd_tbl))
+		goto out_drop;
+
 	rcu_read_lock();
 	if (!nh) {
 		dst = skb_dst(skb);

-- 
2.53.0

Re: [PATCH net v3 2/3] bpf: bpf_out_neigh_v6: Fix nd_tbl NULL dereference when IPv6 is disabled

[Jakub Kicinski]

On Thu, 05 Mar 2026 18:29:56 -0300 Ricardo B. Marlière wrote:
> +++ b/net/core/filter.c
> @@ -2228,6 +2228,9 @@ static int bpf_out_neigh_v6(struct net *net, struct sk_buff *skb,
>  			return -ENOMEM;
>  	}
>  
> +	if (unlikely(!ipv6_stub->nd_tbl))
> +		goto out_drop;

So neither Fernando nor you checked whether this code can be built
as a module? ipv6_mod_enabled() should work just fine

SMH

Re: [PATCH net v3 2/3] bpf: bpf_out_neigh_v6: Fix nd_tbl NULL dereference when IPv6 is disabled

[Fernando Fernandez Mancera]

On 3/6/26 3:25 AM, Jakub Kicinski wrote:
> On Thu, 05 Mar 2026 18:29:56 -0300 Ricardo B. Marlière wrote:
>> +++ b/net/core/filter.c
>> @@ -2228,6 +2228,9 @@ static int bpf_out_neigh_v6(struct net *net, struct sk_buff *skb,
>>   			return -ENOMEM;
>>   	}
>>   
>> +	if (unlikely(!ipv6_stub->nd_tbl))
>> +		goto out_drop;
> 
> So neither Fernando nor you checked whether this code can be built
> as a module? ipv6_mod_enabled() should work just fine
> 

I checked it. If IPV6=m this is not fine.

ld: vmlinux.o: in function `bpf_out_neigh_v6':
filter.c:(.text+0x3231d60): undefined reference to `ipv6_mod_enabled'

> SMH

Re: [PATCH net v3 2/3] bpf: bpf_out_neigh_v6: Fix nd_tbl NULL dereference when IPv6 is disabled

[Jakub Kicinski]

On Fri, 6 Mar 2026 10:58:44 +0100 Fernando Fernandez Mancera wrote:
> >> +	if (unlikely(!ipv6_stub->nd_tbl))
> >> +		goto out_drop;  
> > 
> > So neither Fernando nor you checked whether this code can be built
> > as a module? ipv6_mod_enabled() should work just fine
> 
> I checked it. If IPV6=m this is not fine.
> 
> ld: vmlinux.o: in function `bpf_out_neigh_v6':
> filter.c:(.text+0x3231d60): undefined reference to `ipv6_mod_enabled'

Guess I got it backwards :/ Should we add this to the series?

-->8--------
Subject: ipv6: move the disable_ipv6_mod knob to core code

Make sure disable_ipv6_mod itself is not part of the IPv6 module,
in case core code wants to refer to it. We will remove support
for IPv6=m soon, this change helps make fixes we commit before
that less messy.

Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
 include/linux/ipv6.h | 7 ++++++-
 net/ipv4/af_inet.c   | 6 ++++++
 net/ipv6/af_inet6.c  | 8 --------
 3 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index 443053a76dcf..e5b6853d517a 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -333,7 +333,12 @@ struct tcp6_timewait_sock {
 };
 
 #if IS_ENABLED(CONFIG_IPV6)
-bool ipv6_mod_enabled(void);
+extern int disable_ipv6_mod;
+
+static inline bool ipv6_mod_enabled(void)
+{
+        return disable_ipv6_mod == 0;
+}
 
 static inline struct ipv6_pinfo *inet6_sk(const struct sock *__sk)
 {
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index babcd75a08e2..f1944e8fd9d3 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -124,6 +124,12 @@
 
 #include <trace/events/sock.h>
 
+/* Keep the definition of IPv6 disable here for now, to avoid annoying linker
+ * issues in case IPv6=m
+ */
+int disable_ipv6_mod;
+EXPORT_SYMBOL(disable_ipv6_mod);
+
 /* The inetsw table contains everything that inet_create needs to
  * build a new socket.
  */
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 0b995a961359..03c175cbbdb6 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -86,8 +86,6 @@ struct ipv6_params ipv6_defaults = {
 	.autoconf = 1,
 };
 
-static int disable_ipv6_mod;
-
 module_param_named(disable, disable_ipv6_mod, int, 0444);
 MODULE_PARM_DESC(disable, "Disable IPv6 module such that it is non-functional");
 
@@ -97,12 +95,6 @@ MODULE_PARM_DESC(disable_ipv6, "Disable IPv6 on all interfaces");
 module_param_named(autoconf, ipv6_defaults.autoconf, int, 0444);
 MODULE_PARM_DESC(autoconf, "Enable IPv6 address autoconfiguration on all interfaces");
 
-bool ipv6_mod_enabled(void)
-{
-	return disable_ipv6_mod == 0;
-}
-EXPORT_SYMBOL_GPL(ipv6_mod_enabled);
-
 static struct ipv6_pinfo *inet6_sk_generic(struct sock *sk)
 {
 	const int offset = sk->sk_prot->ipv6_pinfo_offset;
-- 
2.53.0

Re: [PATCH net v3 2/3] bpf: bpf_out_neigh_v6: Fix nd_tbl NULL dereference when IPv6 is disabled

[Fernando Fernandez Mancera]

On 3/7/26 3:39 AM, Jakub Kicinski wrote:
> On Fri, 6 Mar 2026 10:58:44 +0100 Fernando Fernandez Mancera wrote:
>>>> +	if (unlikely(!ipv6_stub->nd_tbl))
>>>> +		goto out_drop;
>>>
>>> So neither Fernando nor you checked whether this code can be built
>>> as a module? ipv6_mod_enabled() should work just fine
>>
>> I checked it. If IPV6=m this is not fine.
>>
>> ld: vmlinux.o: in function `bpf_out_neigh_v6':
>> filter.c:(.text+0x3231d60): undefined reference to `ipv6_mod_enabled'
> 
> Guess I got it backwards :/ Should we add this to the series?
> 

No worries.

> -->8--------
> Subject: ipv6: move the disable_ipv6_mod knob to core code
> 
> Make sure disable_ipv6_mod itself is not part of the IPv6 module,
> in case core code wants to refer to it. We will remove support
> for IPv6=m soon, this change helps make fixes we commit before
> that less messy.
> 
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> ---

Ricardo could you add it and check if it is fine? FWIW; I am sending 
today the series removing IPV6=m after some testing to net-next tree.

Thanks,
Fernando.

>   include/linux/ipv6.h | 7 ++++++-
>   net/ipv4/af_inet.c   | 6 ++++++
>   net/ipv6/af_inet6.c  | 8 --------
>   3 files changed, 12 insertions(+), 9 deletions(-)
> 
> diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
> index 443053a76dcf..e5b6853d517a 100644
> --- a/include/linux/ipv6.h
> +++ b/include/linux/ipv6.h
> @@ -333,7 +333,12 @@ struct tcp6_timewait_sock {
>   };
>   
>   #if IS_ENABLED(CONFIG_IPV6)
> -bool ipv6_mod_enabled(void);
> +extern int disable_ipv6_mod;
> +
> +static inline bool ipv6_mod_enabled(void)
> +{
> +        return disable_ipv6_mod == 0;
> +}
>   
>   static inline struct ipv6_pinfo *inet6_sk(const struct sock *__sk)
>   {
> diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
> index babcd75a08e2..f1944e8fd9d3 100644
> --- a/net/ipv4/af_inet.c
> +++ b/net/ipv4/af_inet.c
> @@ -124,6 +124,12 @@
>   
>   #include <trace/events/sock.h>
>   
> +/* Keep the definition of IPv6 disable here for now, to avoid annoying linker
> + * issues in case IPv6=m
> + */
> +int disable_ipv6_mod;
> +EXPORT_SYMBOL(disable_ipv6_mod);
> +
>   /* The inetsw table contains everything that inet_create needs to
>    * build a new socket.
>    */
> diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
> index 0b995a961359..03c175cbbdb6 100644
> --- a/net/ipv6/af_inet6.c
> +++ b/net/ipv6/af_inet6.c
> @@ -86,8 +86,6 @@ struct ipv6_params ipv6_defaults = {
>   	.autoconf = 1,
>   };
>   
> -static int disable_ipv6_mod;
> -
>   module_param_named(disable, disable_ipv6_mod, int, 0444);
>   MODULE_PARM_DESC(disable, "Disable IPv6 module such that it is non-functional");
>   
> @@ -97,12 +95,6 @@ MODULE_PARM_DESC(disable_ipv6, "Disable IPv6 on all interfaces");
>   module_param_named(autoconf, ipv6_defaults.autoconf, int, 0444);
>   MODULE_PARM_DESC(autoconf, "Enable IPv6 address autoconfiguration on all interfaces");
>   
> -bool ipv6_mod_enabled(void)
> -{
> -	return disable_ipv6_mod == 0;
> -}
> -EXPORT_SYMBOL_GPL(ipv6_mod_enabled);
> -
>   static struct ipv6_pinfo *inet6_sk_generic(struct sock *sk)
>   {
>   	const int offset = sk->sk_prot->ipv6_pinfo_offset;

Re: [PATCH net v3 2/3] bpf: bpf_out_neigh_v6: Fix nd_tbl NULL dereference when IPv6 is disabled

[Ricardo B. Marlière]

On Sat Mar 7, 2026 at 4:27 AM -03, Fernando Fernandez Mancera wrote:
> On 3/7/26 3:39 AM, Jakub Kicinski wrote:
>> On Fri, 6 Mar 2026 10:58:44 +0100 Fernando Fernandez Mancera wrote:
>>>>> +	if (unlikely(!ipv6_stub->nd_tbl))
>>>>> +		goto out_drop;
>>>>
>>>> So neither Fernando nor you checked whether this code can be built
>>>> as a module? ipv6_mod_enabled() should work just fine
>>>
>>> I checked it. If IPV6=m this is not fine.
>>>
>>> ld: vmlinux.o: in function `bpf_out_neigh_v6':
>>> filter.c:(.text+0x3231d60): undefined reference to `ipv6_mod_enabled'
>> 
>> Guess I got it backwards :/ Should we add this to the series?
>> 

Nice, thank you!

>
> No worries.
>
>> -->8--------
>> Subject: ipv6: move the disable_ipv6_mod knob to core code
>> 
>> Make sure disable_ipv6_mod itself is not part of the IPv6 module,
>> in case core code wants to refer to it. We will remove support
>> for IPv6=m soon, this change helps make fixes we commit before
>> that less messy.
>> 
>> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
>> ---
>
> Ricardo could you add it and check if it is fine? FWIW; I am sending 
> today the series removing IPV6=m after some testing to net-next tree.

Will do!

>
> Thanks,
> Fernando.
>
>>   include/linux/ipv6.h | 7 ++++++-
>>   net/ipv4/af_inet.c   | 6 ++++++
>>   net/ipv6/af_inet6.c  | 8 --------
>>   3 files changed, 12 insertions(+), 9 deletions(-)
>> 
>> diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
>> index 443053a76dcf..e5b6853d517a 100644
>> --- a/include/linux/ipv6.h
>> +++ b/include/linux/ipv6.h
>> @@ -333,7 +333,12 @@ struct tcp6_timewait_sock {
>>   };
>>   
>>   #if IS_ENABLED(CONFIG_IPV6)
>> -bool ipv6_mod_enabled(void);
>> +extern int disable_ipv6_mod;
>> +
>> +static inline bool ipv6_mod_enabled(void)
>> +{
>> +        return disable_ipv6_mod == 0;
>> +}
>>   
>>   static inline struct ipv6_pinfo *inet6_sk(const struct sock *__sk)
>>   {
>> diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
>> index babcd75a08e2..f1944e8fd9d3 100644
>> --- a/net/ipv4/af_inet.c
>> +++ b/net/ipv4/af_inet.c
>> @@ -124,6 +124,12 @@
>>   
>>   #include <trace/events/sock.h>
>>   
>> +/* Keep the definition of IPv6 disable here for now, to avoid annoying linker
>> + * issues in case IPv6=m
>> + */
>> +int disable_ipv6_mod;
>> +EXPORT_SYMBOL(disable_ipv6_mod);
>> +
>>   /* The inetsw table contains everything that inet_create needs to
>>    * build a new socket.
>>    */
>> diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
>> index 0b995a961359..03c175cbbdb6 100644
>> --- a/net/ipv6/af_inet6.c
>> +++ b/net/ipv6/af_inet6.c
>> @@ -86,8 +86,6 @@ struct ipv6_params ipv6_defaults = {
>>   	.autoconf = 1,
>>   };
>>   
>> -static int disable_ipv6_mod;
>> -
>>   module_param_named(disable, disable_ipv6_mod, int, 0444);
>>   MODULE_PARM_DESC(disable, "Disable IPv6 module such that it is non-functional");
>>   
>> @@ -97,12 +95,6 @@ MODULE_PARM_DESC(disable_ipv6, "Disable IPv6 on all interfaces");
>>   module_param_named(autoconf, ipv6_defaults.autoconf, int, 0444);
>>   MODULE_PARM_DESC(autoconf, "Enable IPv6 address autoconfiguration on all interfaces");
>>   
>> -bool ipv6_mod_enabled(void)
>> -{
>> -	return disable_ipv6_mod == 0;
>> -}
>> -EXPORT_SYMBOL_GPL(ipv6_mod_enabled);
>> -
>>   static struct ipv6_pinfo *inet6_sk_generic(struct sock *sk)
>>   {
>>   	const int offset = sk->sk_prot->ipv6_pinfo_offset;

[PATCH net v3 3/3] net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled

[Ricardo B. Marlière]

When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never
initialized because inet6_init() exits before ndisc_init() is called
which initializes it. If bonding ARP/NS validation is enabled, an IPv6
NS/NA packet received on a slave can reach bond_validate_na(), which
calls bond_has_this_ip6(). That path calls ipv6_chk_addr() and can
crash in __ipv6_chk_addr_and_flags().

 BUG: kernel NULL pointer dereference, address: 00000000000005d8
 Oops: Oops: 0000 [#1] SMP NOPTI
 RIP: 0010:__ipv6_chk_addr_and_flags+0x69/0x170
 Call Trace:
  <IRQ>
  ipv6_chk_addr+0x1f/0x30
  bond_validate_na+0x12e/0x1d0 [bonding]
  ? __pfx_bond_handle_frame+0x10/0x10 [bonding]
  bond_rcv_validate+0x1a0/0x450 [bonding]
  bond_handle_frame+0x5e/0x290 [bonding]
  ? srso_alias_return_thunk+0x5/0xfbef5
  __netif_receive_skb_core.constprop.0+0x3e8/0xe50
  ? srso_alias_return_thunk+0x5/0xfbef5
  ? update_cfs_rq_load_avg+0x1a/0x240
  ? srso_alias_return_thunk+0x5/0xfbef5
  ? __enqueue_entity+0x5e/0x240
  __netif_receive_skb_one_core+0x39/0xa0
  process_backlog+0x9c/0x150
  __napi_poll+0x30/0x200
  ? srso_alias_return_thunk+0x5/0xfbef5
  net_rx_action+0x338/0x3b0
  handle_softirqs+0xc9/0x2a0
  do_softirq+0x42/0x60
  </IRQ>
  <TASK>
  __local_bh_enable_ip+0x62/0x70
  __dev_queue_xmit+0x2d3/0x1000
  ? srso_alias_return_thunk+0x5/0xfbef5
  ? srso_alias_return_thunk+0x5/0xfbef5
  ? packet_parse_headers+0x10a/0x1a0
  packet_sendmsg+0x10da/0x1700
  ? kick_pool+0x5f/0x140
  ? srso_alias_return_thunk+0x5/0xfbef5
  ? __queue_work+0x12d/0x4f0
  __sys_sendto+0x1f3/0x220
  __x64_sys_sendto+0x24/0x30
  do_syscall_64+0x101/0xf80
  ? exc_page_fault+0x6e/0x170
  ? srso_alias_return_thunk+0x5/0xfbef5
  entry_SYSCALL_64_after_hwframe+0x77/0x7f
  </TASK>

Fix this by adding an early check in bond_confirm_addr6(). If
ipv6_stub->nd_tbl is NULL, return before calling ipv6_chk_addr().

Suggested-by: Fernando Fernandez Mancera <fmancera@suse.de>
Fixes: 4e24be018eb9 ("bonding: add new parameter ns_targets")
Signed-off-by: Ricardo B. Marlière <rbm@suse.com>
---
 drivers/net/bonding/bond_main.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 14ed91391fcc..7d32cd231633 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -3256,6 +3256,9 @@ static int bond_confirm_addr6(struct net_device *dev,
 {
 	struct in6_addr *addr = (struct in6_addr *)priv->data;
 
+	if (unlikely(!ipv6_mod_enabled()))
+		return 0;
+
 	return ipv6_chk_addr(dev_net(dev), addr, dev, 0);
 }
 

-- 
2.53.0

Re: [PATCH net v3 0/3] {net,bpf}: nd_tbl fixes for when ipv6.disable=1

[Jakub Kicinski]

On Thu, 05 Mar 2026 18:29:54 -0300 Ricardo B. Marlière wrote:
> Signed-off-by: Ricardo B. Marlière <rbm@suse.com>
> ---
> Changes in v3:
> - Don't use ipv6_mod_enabled() in net/core/filter.c.
> - Link to v2: https://lore.kernel.org/r/20260305-net-nd_tbl_fixes-v2-0-b7177db1a9f3@suse.com
> 
> Changes in v2:
> - Used ipv6_mod_enabled() helper, guarded by unlikely().
> - Link to v1: https://lore.kernel.org/r/20260228-net-nd_tbl_fixes-v1-0-2b2a274df9bb@suse.com

Please add some content to the cover letter, you're basically sending
an empty email now. And please read this:
https://www.kernel.org/doc/html/next/process/maintainer-netdev.html
-- 
pw-bot: cr