Re: [PATCH net] ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()

Eric Dumazet
2026-04-03T21:47:45Z

On Fri, Apr 3, 2026 at 2:44 PM Jakub Kicinski <kuba@kernel.org> wrote:
>
> This is an AI-generated review of your patch. The human sending this
> email says "more bugs to fix.."
> ---
> ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()
>
> This commit fixes potential NULL pointer dereferences in
> __ioam6_fill_trace_data() by checking __in6_dev_get() and using
> skb_dst_dev_rcu(). It also adds missing READ_ONCE() annotations.
>
> > diff --git a/net/ipv6/ioam6.c b/net/ipv6/ioam6.c
> > index 3978773bec42..05a0b7d7e2aa 100644
> > --- a/net/ipv6/ioam6.c
> > +++ b/net/ipv6/ioam6.c
> > @@ -710,7 +710,9 @@ static void __ioam6_fill_trace_data(struct sk_buff *skb,
> > struct ioam6_schema *sc,
> > unsigned int sclen, bool is_input)
> > {
> > - struct net_device *dev = skb_dst_dev(skb);
> > + /* Note: skb_dst_dev_rcu() can't be NULL at this point. */
> > + struct net_device *dev = skb_dst_dev_rcu(skb);
>
> Could this code lead to an out-of-bounds access of the dev->_tx[] array
> further down in this function?
>
> While reviewing this patch, a pre-existing regression was noticed when
> trace->type.bit6 is set:
>
> if (trace->type.bit6) {
> ...
> queue = skb_get_tx_queue(dev, skb);
> qdisc = rcu_dereference(queue->qdisc);
>
> When is_input is true, the packet is on the RX path and skb->queue_mapping
> contains the RX queue index of the ingress device.
>
> If the ingress device has more RX queues than the egress device (dev) has
> TX queues, skb_get_queue_mapping(skb) will exceed dev->num_tx_queues.
>
> Since skb_get_tx_queue() does not clamp the index, will it return an
> out-of-bounds pointer into the egress device's dev->_tx array, causing
> dereferencing queue->qdisc to read invalid memory?

This seems a different bug ?

I mean, do we need to fix all bug in a single patch ?