* [PATCH net v2] vxlan: fix NULL vn6_sock dereference in vxlan_igmp_join() and vxlan_igmp_leave()
@ 2026-04-18 11:41 Weiming Shi
2026-04-18 15:58 ` Ido Schimmel
0 siblings, 1 reply; 3+ messages in thread
From: Weiming Shi @ 2026-04-18 11:41 UTC (permalink / raw)
To: Andrew Lunn, David S . Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni
Cc: Roopa Prabhu, netdev, Xiang Mei, Weiming Shi
vxlan_sock_add() tolerates IPv6 socket creation failure with
-EAFNOSUPPORT (e.g. ipv6.disable=1), leaving vn6_sock as NULL while
successfully creating vn4_sock. vxlan_igmp_join() and
vxlan_igmp_leave() then crash when they dereference the NULL vn6_sock
for VNI filter entries with IPv6 multicast groups:
Oops: general protection fault, probably for non-canonical address
0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
RIP: 0010:vxlan_igmp_join (drivers/net/vxlan/vxlan_multicast.c:40)
Call Trace:
vxlan_multicast_join (drivers/net/vxlan/vxlan_multicast.c:195)
vxlan_open (drivers/net/vxlan/vxlan_core.c:2965)
__dev_open (net/core/dev.c:1704)
__dev_change_flags (net/core/dev.c:9781)
do_setlink.isra.0 (net/core/rtnetlink.c:3180)
rtnl_newlink (net/core/rtnetlink.c:4238)
rtnetlink_rcv_msg (net/core/rtnetlink.c:6921)
Skip the IPv6 multicast join/leave when vn6_sock is NULL, consistent
with how vxlan_sock_add() tolerates missing IPv6 support.
Fixes: f9c4bb0b245c ("vxlan: vni filtering support on collect metadata device")
Reported-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
---
v2:
- drop sock4 NULL checks
drivers/net/vxlan/vxlan_multicast.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/net/vxlan/vxlan_multicast.c b/drivers/net/vxlan/vxlan_multicast.c
index a7f2d67dc61b..e6aa5ab1c939 100644
--- a/drivers/net/vxlan/vxlan_multicast.c
+++ b/drivers/net/vxlan/vxlan_multicast.c
@@ -37,6 +37,9 @@ int vxlan_igmp_join(struct vxlan_dev *vxlan, union vxlan_addr *rip,
} else {
struct vxlan_sock *sock6 = rtnl_dereference(vxlan->vn6_sock);
+ if (!sock6)
+ return 0;
+
sk = sock6->sock->sk;
lock_sock(sk);
ret = ipv6_stub->ipv6_sock_mc_join(sk, ifindex,
@@ -71,6 +74,9 @@ int vxlan_igmp_leave(struct vxlan_dev *vxlan, union vxlan_addr *rip,
} else {
struct vxlan_sock *sock6 = rtnl_dereference(vxlan->vn6_sock);
+ if (!sock6)
+ return 0;
+
sk = sock6->sock->sk;
lock_sock(sk);
ret = ipv6_stub->ipv6_sock_mc_drop(sk, ifindex,
--
2.43.0
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH net v2] vxlan: fix NULL vn6_sock dereference in vxlan_igmp_join() and vxlan_igmp_leave()
2026-04-18 11:41 [PATCH net v2] vxlan: fix NULL vn6_sock dereference in vxlan_igmp_join() and vxlan_igmp_leave() Weiming Shi
@ 2026-04-18 15:58 ` Ido Schimmel
2026-04-18 16:08 ` Weiming Shi
0 siblings, 1 reply; 3+ messages in thread
From: Ido Schimmel @ 2026-04-18 15:58 UTC (permalink / raw)
To: Weiming Shi
Cc: Andrew Lunn, David S . Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Roopa Prabhu, netdev, Xiang Mei
On Sat, Apr 18, 2026 at 04:41:12AM -0700, Weiming Shi wrote:
> vxlan_sock_add() tolerates IPv6 socket creation failure with
> -EAFNOSUPPORT (e.g. ipv6.disable=1), leaving vn6_sock as NULL while
> successfully creating vn4_sock. vxlan_igmp_join() and
> vxlan_igmp_leave() then crash when they dereference the NULL vn6_sock
> for VNI filter entries with IPv6 multicast groups:
>
> Oops: general protection fault, probably for non-canonical address
> 0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI
> KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
> RIP: 0010:vxlan_igmp_join (drivers/net/vxlan/vxlan_multicast.c:40)
> Call Trace:
> vxlan_multicast_join (drivers/net/vxlan/vxlan_multicast.c:195)
> vxlan_open (drivers/net/vxlan/vxlan_core.c:2965)
> __dev_open (net/core/dev.c:1704)
> __dev_change_flags (net/core/dev.c:9781)
> do_setlink.isra.0 (net/core/rtnetlink.c:3180)
> rtnl_newlink (net/core/rtnetlink.c:4238)
> rtnetlink_rcv_msg (net/core/rtnetlink.c:6921)
>
> Skip the IPv6 multicast join/leave when vn6_sock is NULL, consistent
> with how vxlan_sock_add() tolerates missing IPv6 support.
>
> Fixes: f9c4bb0b245c ("vxlan: vni filtering support on collect metadata device")
> Reported-by: Xiang Mei <xmei5@asu.edu>
> Signed-off-by: Weiming Shi <bestswngs@gmail.com>
AFAICT, this is the same patch as:
https://lore.kernel.org/netdev/20260323095544.3311285-4-bestswngs@gmail.com/
If you disagree with the feedback, then please comment there instead of
reposting the patch.
> ---
> v2:
> - drop sock4 NULL checks
>
> drivers/net/vxlan/vxlan_multicast.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/drivers/net/vxlan/vxlan_multicast.c b/drivers/net/vxlan/vxlan_multicast.c
> index a7f2d67dc61b..e6aa5ab1c939 100644
> --- a/drivers/net/vxlan/vxlan_multicast.c
> +++ b/drivers/net/vxlan/vxlan_multicast.c
> @@ -37,6 +37,9 @@ int vxlan_igmp_join(struct vxlan_dev *vxlan, union vxlan_addr *rip,
> } else {
> struct vxlan_sock *sock6 = rtnl_dereference(vxlan->vn6_sock);
>
> + if (!sock6)
> + return 0;
> +
> sk = sock6->sock->sk;
> lock_sock(sk);
> ret = ipv6_stub->ipv6_sock_mc_join(sk, ifindex,
This line changed in commit 29ae61b2fe7e ("drivers: net: drop ipv6_stub
usage and use direct function calls")
> @@ -71,6 +74,9 @@ int vxlan_igmp_leave(struct vxlan_dev *vxlan, union vxlan_addr *rip,
> } else {
> struct vxlan_sock *sock6 = rtnl_dereference(vxlan->vn6_sock);
>
> + if (!sock6)
> + return 0;
> +
> sk = sock6->sock->sk;
> lock_sock(sk);
> ret = ipv6_stub->ipv6_sock_mc_drop(sk, ifindex,
> --
> 2.43.0
>
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH net v2] vxlan: fix NULL vn6_sock dereference in vxlan_igmp_join() and vxlan_igmp_leave()
2026-04-18 15:58 ` Ido Schimmel
@ 2026-04-18 16:08 ` Weiming Shi
0 siblings, 0 replies; 3+ messages in thread
From: Weiming Shi @ 2026-04-18 16:08 UTC (permalink / raw)
To: Ido Schimmel
Cc: Andrew Lunn, David S . Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Roopa Prabhu, netdev, Xiang Mei
On 26-04-18 18:58, Ido Schimmel wrote:
> On Sat, Apr 18, 2026 at 04:41:12AM -0700, Weiming Shi wrote:
> > vxlan_sock_add() tolerates IPv6 socket creation failure with
> > -EAFNOSUPPORT (e.g. ipv6.disable=1), leaving vn6_sock as NULL while
> > successfully creating vn4_sock. vxlan_igmp_join() and
> > vxlan_igmp_leave() then crash when they dereference the NULL vn6_sock
> > for VNI filter entries with IPv6 multicast groups:
> >
> > Oops: general protection fault, probably for non-canonical address
> > 0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI
> > KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
> > RIP: 0010:vxlan_igmp_join (drivers/net/vxlan/vxlan_multicast.c:40)
> > Call Trace:
> > vxlan_multicast_join (drivers/net/vxlan/vxlan_multicast.c:195)
> > vxlan_open (drivers/net/vxlan/vxlan_core.c:2965)
> > __dev_open (net/core/dev.c:1704)
> > __dev_change_flags (net/core/dev.c:9781)
> > do_setlink.isra.0 (net/core/rtnetlink.c:3180)
> > rtnl_newlink (net/core/rtnetlink.c:4238)
> > rtnetlink_rcv_msg (net/core/rtnetlink.c:6921)
> >
> > Skip the IPv6 multicast join/leave when vn6_sock is NULL, consistent
> > with how vxlan_sock_add() tolerates missing IPv6 support.
> >
> > Fixes: f9c4bb0b245c ("vxlan: vni filtering support on collect metadata device")
> > Reported-by: Xiang Mei <xmei5@asu.edu>
> > Signed-off-by: Weiming Shi <bestswngs@gmail.com>
>
> AFAICT, this is the same patch as:
>
> https://lore.kernel.org/netdev/20260323095544.3311285-4-bestswngs@gmail.com/
>
> If you disagree with the feedback, then please comment there instead of
> reposting the patch.
>
Apologies for the duplicate posting - I should have followed up on the
original.
Thanks,
Weiming Shi
> > ---
> > v2:
> > - drop sock4 NULL checks
> >
> > drivers/net/vxlan/vxlan_multicast.c | 6 ++++++
> > 1 file changed, 6 insertions(+)
> >
> > diff --git a/drivers/net/vxlan/vxlan_multicast.c b/drivers/net/vxlan/vxlan_multicast.c
> > index a7f2d67dc61b..e6aa5ab1c939 100644
> > --- a/drivers/net/vxlan/vxlan_multicast.c
> > +++ b/drivers/net/vxlan/vxlan_multicast.c
> > @@ -37,6 +37,9 @@ int vxlan_igmp_join(struct vxlan_dev *vxlan, union vxlan_addr *rip,
> > } else {
> > struct vxlan_sock *sock6 = rtnl_dereference(vxlan->vn6_sock);
> >
> > + if (!sock6)
> > + return 0;
> > +
> > sk = sock6->sock->sk;
> > lock_sock(sk);
> > ret = ipv6_stub->ipv6_sock_mc_join(sk, ifindex,
>
> This line changed in commit 29ae61b2fe7e ("drivers: net: drop ipv6_stub
> usage and use direct function calls")
>
> > @@ -71,6 +74,9 @@ int vxlan_igmp_leave(struct vxlan_dev *vxlan, union vxlan_addr *rip,
> > } else {
> > struct vxlan_sock *sock6 = rtnl_dereference(vxlan->vn6_sock);
> >
> > + if (!sock6)
> > + return 0;
> > +
> > sk = sock6->sock->sk;
> > lock_sock(sk);
> > ret = ipv6_stub->ipv6_sock_mc_drop(sk, ifindex,
> > --
> > 2.43.0
> >
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-04-18 16:08 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-04-18 11:41 [PATCH net v2] vxlan: fix NULL vn6_sock dereference in vxlan_igmp_join() and vxlan_igmp_leave() Weiming Shi
2026-04-18 15:58 ` Ido Schimmel
2026-04-18 16:08 ` Weiming Shi
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox