[PATCH net] net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled

[PATCH net] net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled

[Fernando Fernandez Mancera]

When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never
initialized because inet6_init() exits before ndisc_init() is called
which initializes it. If an IPv6 packet is injected into the interface,
route_shortcircuit() is called and a NULL pointer dereference happens on
neigh_lookup().

 BUG: kernel NULL pointer dereference, address: 0000000000000380
 Oops: Oops: 0000 [#1] SMP NOPTI
 [...]
 RIP: 0010:neigh_lookup+0x20/0x270
 [...]
 Call Trace:
  <TASK>
  vxlan_xmit+0x638/0x1ef0 [vxlan]
  dev_hard_start_xmit+0x9e/0x2e0
  __dev_queue_xmit+0xbee/0x14e0
  packet_sendmsg+0x116f/0x1930
  __sys_sendto+0x1f5/0x200
  __x64_sys_sendto+0x24/0x30
  do_syscall_64+0x12f/0x1590
  entry_SYSCALL_64_after_hwframe+0x76/0x7e

Fix this by adding an early check on route_shortcircuit() when protocol
is IPv6. If ipv6_stub->nd_tbl is NULL, return false.

Fixes: e15a00aafa4b ("vxlan: add ipv6 route short circuit support")
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
---
 drivers/net/vxlan/vxlan_core.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c
index 05558b6afecd..cbb9d1a2d8f9 100644
--- a/drivers/net/vxlan/vxlan_core.c
+++ b/drivers/net/vxlan/vxlan_core.c
@@ -2130,6 +2130,8 @@ static bool route_shortcircuit(struct net_device *dev, struct sk_buff *skb)
 	{
 		struct ipv6hdr *pip6;
 
+		if (!ipv6_stub->nd_tbl)
+			return false;
 		if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
 			return false;
 		pip6 = ipv6_hdr(skb);
-- 
2.53.0

Re: [PATCH net] net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled

[Ido Schimmel]

On Fri, Feb 27, 2026 at 12:27:01PM +0100, Fernando Fernandez Mancera wrote:
> When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never
> initialized because inet6_init() exits before ndisc_init() is called
> which initializes it. If an IPv6 packet is injected into the interface,
> route_shortcircuit() is called and a NULL pointer dereference happens on
> neigh_lookup().

[...]

> 
> Fix this by adding an early check on route_shortcircuit() when protocol
> is IPv6. If ipv6_stub->nd_tbl is NULL, return false.
> 
> Fixes: e15a00aafa4b ("vxlan: add ipv6 route short circuit support")
> Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
> ---
>  drivers/net/vxlan/vxlan_core.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c
> index 05558b6afecd..cbb9d1a2d8f9 100644
> --- a/drivers/net/vxlan/vxlan_core.c
> +++ b/drivers/net/vxlan/vxlan_core.c
> @@ -2130,6 +2130,8 @@ static bool route_shortcircuit(struct net_device *dev, struct sk_buff *skb)
>  	{
>  		struct ipv6hdr *pip6;
>  
> +		if (!ipv6_stub->nd_tbl)

I was wondering why neigh_reduce() doesn't need a similar fix, but then
I realized that's probably because of the __in6_dev_get() check earlier
in the function. Maybe do the same here for consistency and mention that
it relies on commit 804b09be09f8 ("vxlan: Add RCU read-side critical
sections in the Tx path")?

If you still prefer the current approach, then I would use
ipv6_mod_enabled() instead of the NULL check.

> +			return false;
>  		if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
>  			return false;
>  		pip6 = ipv6_hdr(skb);
> -- 
> 2.53.0
> 

Re: [PATCH net] net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled

[Fernando Fernandez Mancera]

On 3/1/26 4:54 PM, Ido Schimmel wrote:
> On Fri, Feb 27, 2026 at 12:27:01PM +0100, Fernando Fernandez Mancera wrote:
>> When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never
>> initialized because inet6_init() exits before ndisc_init() is called
>> which initializes it. If an IPv6 packet is injected into the interface,
>> route_shortcircuit() is called and a NULL pointer dereference happens on
>> neigh_lookup().
> 
> [...]
> 
>>
>> Fix this by adding an early check on route_shortcircuit() when protocol
>> is IPv6. If ipv6_stub->nd_tbl is NULL, return false.
>>
>> Fixes: e15a00aafa4b ("vxlan: add ipv6 route short circuit support")
>> Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
>> ---
>>   drivers/net/vxlan/vxlan_core.c | 2 ++
>>   1 file changed, 2 insertions(+)
>>
>> diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c
>> index 05558b6afecd..cbb9d1a2d8f9 100644
>> --- a/drivers/net/vxlan/vxlan_core.c
>> +++ b/drivers/net/vxlan/vxlan_core.c
>> @@ -2130,6 +2130,8 @@ static bool route_shortcircuit(struct net_device *dev, struct sk_buff *skb)
>>   	{
>>   		struct ipv6hdr *pip6;
>>   
>> +		if (!ipv6_stub->nd_tbl)
> 
> I was wondering why neigh_reduce() doesn't need a similar fix, but then
> I realized that's probably because of the __in6_dev_get() check earlier
> in the function. Maybe do the same here for consistency and mention that
> it relies on commit 804b09be09f8 ("vxlan: Add RCU read-side critical
> sections in the Tx path")?
> 

I didn't know ipv6_mod_enabled() exist and I indeed prefer it. IMHO, it 
is better than the __in6_dev_get() check because here it isn't needed 
and it would be a better arbitrary.

Thanks!

> If you still prefer the current approach, then I would use
> ipv6_mod_enabled() instead of the NULL check.
> 
>> +			return false;
>>   		if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
>>   			return false;
>>   		pip6 = ipv6_hdr(skb);
>> -- 
>> 2.53.0
>>