[PATCH net v2] vxlan: fix NULL vn6_sock dereference in vxlan_igmp_join() and vxlan_igmp_leave()

[PATCH net v2] vxlan: fix NULL vn6_sock dereference in vxlan_igmp_join() and vxlan_igmp_leave()

[Weiming Shi]

vxlan_sock_add() tolerates IPv6 socket creation failure with
-EAFNOSUPPORT (e.g. ipv6.disable=1), leaving vn6_sock as NULL while
successfully creating vn4_sock. vxlan_igmp_join() and
vxlan_igmp_leave() then crash when they dereference the NULL vn6_sock
for VNI filter entries with IPv6 multicast groups:

 Oops: general protection fault, probably for non-canonical address
      0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI
 KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
 RIP: 0010:vxlan_igmp_join (drivers/net/vxlan/vxlan_multicast.c:40)
 Call Trace:
  vxlan_multicast_join (drivers/net/vxlan/vxlan_multicast.c:195)
  vxlan_open (drivers/net/vxlan/vxlan_core.c:2965)
  __dev_open (net/core/dev.c:1704)
  __dev_change_flags (net/core/dev.c:9781)
  do_setlink.isra.0 (net/core/rtnetlink.c:3180)
  rtnl_newlink (net/core/rtnetlink.c:4238)
  rtnetlink_rcv_msg (net/core/rtnetlink.c:6921)

Skip the IPv6 multicast join/leave when vn6_sock is NULL, consistent
with how vxlan_sock_add() tolerates missing IPv6 support.

Fixes: f9c4bb0b245c ("vxlan: vni filtering support on collect metadata device")
Reported-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
---
v2:
  - drop sock4 NULL checks 

 drivers/net/vxlan/vxlan_multicast.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/net/vxlan/vxlan_multicast.c b/drivers/net/vxlan/vxlan_multicast.c
index a7f2d67dc61b..e6aa5ab1c939 100644
--- a/drivers/net/vxlan/vxlan_multicast.c
+++ b/drivers/net/vxlan/vxlan_multicast.c
@@ -37,6 +37,9 @@ int vxlan_igmp_join(struct vxlan_dev *vxlan, union vxlan_addr *rip,
 	} else {
 		struct vxlan_sock *sock6 = rtnl_dereference(vxlan->vn6_sock);
 
+		if (!sock6)
+			return 0;
+
 		sk = sock6->sock->sk;
 		lock_sock(sk);
 		ret = ipv6_stub->ipv6_sock_mc_join(sk, ifindex,
@@ -71,6 +74,9 @@ int vxlan_igmp_leave(struct vxlan_dev *vxlan, union vxlan_addr *rip,
 	} else {
 		struct vxlan_sock *sock6 = rtnl_dereference(vxlan->vn6_sock);
 
+		if (!sock6)
+			return 0;
+
 		sk = sock6->sock->sk;
 		lock_sock(sk);
 		ret = ipv6_stub->ipv6_sock_mc_drop(sk, ifindex,
-- 
2.43.0

Re: [PATCH net v2] vxlan: fix NULL vn6_sock dereference in vxlan_igmp_join() and vxlan_igmp_leave()

[Ido Schimmel]

On Sat, Apr 18, 2026 at 04:41:12AM -0700, Weiming Shi wrote:
> vxlan_sock_add() tolerates IPv6 socket creation failure with
> -EAFNOSUPPORT (e.g. ipv6.disable=1), leaving vn6_sock as NULL while
> successfully creating vn4_sock. vxlan_igmp_join() and
> vxlan_igmp_leave() then crash when they dereference the NULL vn6_sock
> for VNI filter entries with IPv6 multicast groups:
> 
>  Oops: general protection fault, probably for non-canonical address
>       0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI
>  KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
>  RIP: 0010:vxlan_igmp_join (drivers/net/vxlan/vxlan_multicast.c:40)
>  Call Trace:
>   vxlan_multicast_join (drivers/net/vxlan/vxlan_multicast.c:195)
>   vxlan_open (drivers/net/vxlan/vxlan_core.c:2965)
>   __dev_open (net/core/dev.c:1704)
>   __dev_change_flags (net/core/dev.c:9781)
>   do_setlink.isra.0 (net/core/rtnetlink.c:3180)
>   rtnl_newlink (net/core/rtnetlink.c:4238)
>   rtnetlink_rcv_msg (net/core/rtnetlink.c:6921)
> 
> Skip the IPv6 multicast join/leave when vn6_sock is NULL, consistent
> with how vxlan_sock_add() tolerates missing IPv6 support.
> 
> Fixes: f9c4bb0b245c ("vxlan: vni filtering support on collect metadata device")
> Reported-by: Xiang Mei <xmei5@asu.edu>
> Signed-off-by: Weiming Shi <bestswngs@gmail.com>

AFAICT, this is the same patch as:

https://lore.kernel.org/netdev/20260323095544.3311285-4-bestswngs@gmail.com/

If you disagree with the feedback, then please comment there instead of
reposting the patch.

> ---
> v2:
>   - drop sock4 NULL checks 
> 
>  drivers/net/vxlan/vxlan_multicast.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/drivers/net/vxlan/vxlan_multicast.c b/drivers/net/vxlan/vxlan_multicast.c
> index a7f2d67dc61b..e6aa5ab1c939 100644
> --- a/drivers/net/vxlan/vxlan_multicast.c
> +++ b/drivers/net/vxlan/vxlan_multicast.c
> @@ -37,6 +37,9 @@ int vxlan_igmp_join(struct vxlan_dev *vxlan, union vxlan_addr *rip,
>  	} else {
>  		struct vxlan_sock *sock6 = rtnl_dereference(vxlan->vn6_sock);
>  
> +		if (!sock6)
> +			return 0;
> +
>  		sk = sock6->sock->sk;
>  		lock_sock(sk);
>  		ret = ipv6_stub->ipv6_sock_mc_join(sk, ifindex,

This line changed in commit 29ae61b2fe7e ("drivers: net: drop ipv6_stub
usage and use direct function calls")

> @@ -71,6 +74,9 @@ int vxlan_igmp_leave(struct vxlan_dev *vxlan, union vxlan_addr *rip,
>  	} else {
>  		struct vxlan_sock *sock6 = rtnl_dereference(vxlan->vn6_sock);
>  
> +		if (!sock6)
> +			return 0;
> +
>  		sk = sock6->sock->sk;
>  		lock_sock(sk);
>  		ret = ipv6_stub->ipv6_sock_mc_drop(sk, ifindex,
> -- 
> 2.43.0
> 

Re: [PATCH net v2] vxlan: fix NULL vn6_sock dereference in vxlan_igmp_join() and vxlan_igmp_leave()

[Weiming Shi]

On 26-04-18 18:58, Ido Schimmel wrote:
> On Sat, Apr 18, 2026 at 04:41:12AM -0700, Weiming Shi wrote:
> > vxlan_sock_add() tolerates IPv6 socket creation failure with
> > -EAFNOSUPPORT (e.g. ipv6.disable=1), leaving vn6_sock as NULL while
> > successfully creating vn4_sock. vxlan_igmp_join() and
> > vxlan_igmp_leave() then crash when they dereference the NULL vn6_sock
> > for VNI filter entries with IPv6 multicast groups:
> > 
> >  Oops: general protection fault, probably for non-canonical address
> >       0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI
> >  KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
> >  RIP: 0010:vxlan_igmp_join (drivers/net/vxlan/vxlan_multicast.c:40)
> >  Call Trace:
> >   vxlan_multicast_join (drivers/net/vxlan/vxlan_multicast.c:195)
> >   vxlan_open (drivers/net/vxlan/vxlan_core.c:2965)
> >   __dev_open (net/core/dev.c:1704)
> >   __dev_change_flags (net/core/dev.c:9781)
> >   do_setlink.isra.0 (net/core/rtnetlink.c:3180)
> >   rtnl_newlink (net/core/rtnetlink.c:4238)
> >   rtnetlink_rcv_msg (net/core/rtnetlink.c:6921)
> > 
> > Skip the IPv6 multicast join/leave when vn6_sock is NULL, consistent
> > with how vxlan_sock_add() tolerates missing IPv6 support.
> > 
> > Fixes: f9c4bb0b245c ("vxlan: vni filtering support on collect metadata device")
> > Reported-by: Xiang Mei <xmei5@asu.edu>
> > Signed-off-by: Weiming Shi <bestswngs@gmail.com>
> 
> AFAICT, this is the same patch as:
> 
> https://lore.kernel.org/netdev/20260323095544.3311285-4-bestswngs@gmail.com/
> 
> If you disagree with the feedback, then please comment there instead of
> reposting the patch.
> 
Apologies for the duplicate posting - I should have followed up on the
original.

Thanks,
Weiming Shi
> > ---
> > v2:
> >   - drop sock4 NULL checks 
> > 
> >  drivers/net/vxlan/vxlan_multicast.c | 6 ++++++
> >  1 file changed, 6 insertions(+)
> > 
> > diff --git a/drivers/net/vxlan/vxlan_multicast.c b/drivers/net/vxlan/vxlan_multicast.c
> > index a7f2d67dc61b..e6aa5ab1c939 100644
> > --- a/drivers/net/vxlan/vxlan_multicast.c
> > +++ b/drivers/net/vxlan/vxlan_multicast.c
> > @@ -37,6 +37,9 @@ int vxlan_igmp_join(struct vxlan_dev *vxlan, union vxlan_addr *rip,
> >  	} else {
> >  		struct vxlan_sock *sock6 = rtnl_dereference(vxlan->vn6_sock);
> >  
> > +		if (!sock6)
> > +			return 0;
> > +
> >  		sk = sock6->sock->sk;
> >  		lock_sock(sk);
> >  		ret = ipv6_stub->ipv6_sock_mc_join(sk, ifindex,
> 
> This line changed in commit 29ae61b2fe7e ("drivers: net: drop ipv6_stub
> usage and use direct function calls")
> 
> > @@ -71,6 +74,9 @@ int vxlan_igmp_leave(struct vxlan_dev *vxlan, union vxlan_addr *rip,
> >  	} else {
> >  		struct vxlan_sock *sock6 = rtnl_dereference(vxlan->vn6_sock);
> >  
> > +		if (!sock6)
> > +			return 0;
> > +
> >  		sk = sock6->sock->sk;
> >  		lock_sock(sk);
> >  		ret = ipv6_stub->ipv6_sock_mc_drop(sk, ifindex,
> > -- 
> > 2.43.0
> >