Re: [PATCH net] ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()

[Jakub Kicinski <kuba@kernel.org>]

On Sun, 1 Mar 2026 18:38:53 -0700 David Ahern wrote:
> > @@ -1063,7 +1063,8 @@ static struct net_device *ip6_rt_get_dev_rcu(const struct fib6_result *res)
> >  		 */
> >  		if (netif_is_l3_slave(dev) &&
> >  		    !rt6_need_strict(&res->f6i->fib6_dst.addr))
> > -			dev = l3mdev_master_dev_rcu(dev);
> > +			dev = l3mdev_master_dev_rcu(dev) ? :
> > +			      dev_net(dev)->loopback_dev;  
> 
> how can the flag on the netdev say there is L3 master, yet the device
> not be there within an rcu window?

1) We call netif_is_l3_slave() twice, once here and then again in 
l3mdev_master_dev_rcu(), the flag may get cleared in between the two.

2)

static int do_vrf_del_slave(struct net_device *dev, struct net_device *port_dev)
{
        netdev_upper_dev_unlink(port_dev, dev);
	// No sync RCU here, also I'd say the order is inverted?
        port_dev->priv_flags &= ~IFF_L3MDEV_SLAVE;