Re: [PATCH net] net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled

[Ido Schimmel <idosch@nvidia.com>]

On Fri, Feb 27, 2026 at 12:27:01PM +0100, Fernando Fernandez Mancera wrote:
> When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never
> initialized because inet6_init() exits before ndisc_init() is called
> which initializes it. If an IPv6 packet is injected into the interface,
> route_shortcircuit() is called and a NULL pointer dereference happens on
> neigh_lookup().

[...]

> 
> Fix this by adding an early check on route_shortcircuit() when protocol
> is IPv6. If ipv6_stub->nd_tbl is NULL, return false.
> 
> Fixes: e15a00aafa4b ("vxlan: add ipv6 route short circuit support")
> Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
> ---
>  drivers/net/vxlan/vxlan_core.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c
> index 05558b6afecd..cbb9d1a2d8f9 100644
> --- a/drivers/net/vxlan/vxlan_core.c
> +++ b/drivers/net/vxlan/vxlan_core.c
> @@ -2130,6 +2130,8 @@ static bool route_shortcircuit(struct net_device *dev, struct sk_buff *skb)
>  	{
>  		struct ipv6hdr *pip6;
>  
> +		if (!ipv6_stub->nd_tbl)

I was wondering why neigh_reduce() doesn't need a similar fix, but then
I realized that's probably because of the __in6_dev_get() check earlier
in the function. Maybe do the same here for consistency and mention that
it relies on commit 804b09be09f8 ("vxlan: Add RCU read-side critical
sections in the Tx path")?

If you still prefer the current approach, then I would use
ipv6_mod_enabled() instead of the NULL check.

> +			return false;
>  		if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
>  			return false;
>  		pip6 = ipv6_hdr(skb);
> -- 
> 2.53.0
>