Re: [PATCH net] ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()

[Jakub Kicinski <kuba@kernel.org>]

This is an AI-generated review of your patch. The human sending this
email says "more bugs to fix.."
---
ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()

This commit fixes potential NULL pointer dereferences in
__ioam6_fill_trace_data() by checking __in6_dev_get() and using
skb_dst_dev_rcu(). It also adds missing READ_ONCE() annotations.

> diff --git a/net/ipv6/ioam6.c b/net/ipv6/ioam6.c
> index 3978773bec42..05a0b7d7e2aa 100644
> --- a/net/ipv6/ioam6.c
> +++ b/net/ipv6/ioam6.c
> @@ -710,7 +710,9 @@ static void __ioam6_fill_trace_data(struct sk_buff *skb,
>  				    struct ioam6_schema *sc,
>  				    unsigned int sclen, bool is_input)
>  {
> -	struct net_device *dev = skb_dst_dev(skb);
> +	/* Note: skb_dst_dev_rcu() can't be NULL at this point. */
> +	struct net_device *dev = skb_dst_dev_rcu(skb);

Could this code lead to an out-of-bounds access of the dev->_tx[] array
further down in this function?

While reviewing this patch, a pre-existing regression was noticed when
trace->type.bit6 is set:

    if (trace->type.bit6) {
        ...
        queue = skb_get_tx_queue(dev, skb);
        qdisc = rcu_dereference(queue->qdisc);

When is_input is true, the packet is on the RX path and skb->queue_mapping
contains the RX queue index of the ingress device.

If the ingress device has more RX queues than the egress device (dev) has
TX queues, skb_get_queue_mapping(skb) will exceed dev->num_tx_queues.

Since skb_get_tx_queue() does not clamp the index, will it return an
out-of-bounds pointer into the egress device's dev->_tx array, causing
dereferencing queue->qdisc to read invalid memory?