[PATCH net] ipv6: rpl: add NULL check for idev in ipv6_rpl_srh_rcv()

[PATCH net] ipv6: rpl: add NULL check for idev in ipv6_rpl_srh_rcv()

[Andrea Mayer]

ipv6_rpl_srh_rcv() dereferences idev from __in6_dev_get() without
a NULL check when reading idev->cnf.rpl_seg_enabled.
When the device's MTU drops below IPV6_MIN_MTU, addrconf_ifdown()
clears dev->ip6_ptr through RCU_INIT_POINTER(), which is immediately
visible to concurrent readers. A packet that already passed the idev
check in ip6_rcv_core() can race with this and hit a NULL pointer
dereference.

Reproduced by flooding traffic through a route with RPL source routing
while rapidly flapping the receiving interface's MTU between 1500 and
1200:

 BUG: KASAN: null-ptr-deref in ipv6_rpl_srh_rcv+0xae/0x1050
 Read of size 4 at addr 00000000000006b4 by task ping6/318

 CPU: 0 UID: 0 PID: 318 Comm: ping6 Not tainted 7.1.0-rc1-micro-vm-dev-g46f74a3f7d57 #82 PREEMPT(full)
 Call Trace:
  <IRQ>
  kasan_report+0xc6/0x100
  ipv6_rpl_srh_rcv+0xae/0x1050
  ip6_protocol_deliver_rcu+0x717/0x960
  ip6_input_finish+0xa3/0x1b0
  ip6_input+0xdc/0x490
  ipv6_rcv+0x338/0x460
  __netif_receive_skb_one_core+0xd1/0x130
  process_backlog+0x2c7/0x9f0
  __napi_poll.constprop.0+0x51/0x270
  net_rx_action+0x322/0x730
  handle_softirqs+0x119/0x640
  do_softirq+0xae/0xe0
  </IRQ>

Add a NULL check for idev after __in6_dev_get() and drop the skb if
idev is NULL, consistent with the SRv6 fix in commit 064137935262
("ipv6: add NULL checks for idev in SRv6 paths").

Fixes: 8610c7c6e3bd ("net: ipv6: add support for rpl sr exthdr")
Cc: stable@vger.kernel.org
Signed-off-by: Andrea Mayer <andrea.mayer@uniroma2.it>
---
 net/ipv6/exthdrs.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index 03cbce842c1a..e398a8851031 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -499,6 +499,10 @@ static int ipv6_rpl_srh_rcv(struct sk_buff *skb)
 	u32 r;
 
 	idev = __in6_dev_get(skb->dev);
+	if (!idev) {
+		kfree_skb(skb);
+		return -1;
+	}
 
 	accept_rpl_seg = min(READ_ONCE(net->ipv6.devconf_all->rpl_seg_enabled),
 			     READ_ONCE(idev->cnf.rpl_seg_enabled));
-- 
2.20.1

Re: [PATCH net] ipv6: rpl: add NULL check for idev in ipv6_rpl_srh_rcv()

[Eric Dumazet]

On Tue, Apr 28, 2026 at 3:48 PM Andrea Mayer <andrea.mayer@uniroma2.it> wrote:
>
> ipv6_rpl_srh_rcv() dereferences idev from __in6_dev_get() without
> a NULL check when reading idev->cnf.rpl_seg_enabled.
> When the device's MTU drops below IPV6_MIN_MTU, addrconf_ifdown()
> clears dev->ip6_ptr through RCU_INIT_POINTER(), which is immediately
> visible to concurrent readers. A packet that already passed the idev
> check in ip6_rcv_core() can race with this and hit a NULL pointer
> dereference.
>
> Reproduced by flooding traffic through a route with RPL source routing
> while rapidly flapping the receiving interface's MTU between 1500 and
> 1200:
>
>  BUG: KASAN: null-ptr-deref in ipv6_rpl_srh_rcv+0xae/0x1050
>  Read of size 4 at addr 00000000000006b4 by task ping6/318
>
>  CPU: 0 UID: 0 PID: 318 Comm: ping6 Not tainted 7.1.0-rc1-micro-vm-dev-g46f74a3f7d57 #82 PREEMPT(full)
>  Call Trace:
>   <IRQ>
>   kasan_report+0xc6/0x100
>   ipv6_rpl_srh_rcv+0xae/0x1050
>   ip6_protocol_deliver_rcu+0x717/0x960
>   ip6_input_finish+0xa3/0x1b0
>   ip6_input+0xdc/0x490
>   ipv6_rcv+0x338/0x460
>   __netif_receive_skb_one_core+0xd1/0x130
>   process_backlog+0x2c7/0x9f0
>   __napi_poll.constprop.0+0x51/0x270
>   net_rx_action+0x322/0x730
>   handle_softirqs+0x119/0x640
>   do_softirq+0xae/0xe0
>   </IRQ>
>
> Add a NULL check for idev after __in6_dev_get() and drop the skb if
> idev is NULL, consistent with the SRv6 fix in commit 064137935262
> ("ipv6: add NULL checks for idev in SRv6 paths").
>
> Fixes: 8610c7c6e3bd ("net: ipv6: add support for rpl sr exthdr")
> Cc: stable@vger.kernel.org
> Signed-off-by: Andrea Mayer <andrea.mayer@uniroma2.it>
> ---
>  net/ipv6/exthdrs.c | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
> index 03cbce842c1a..e398a8851031 100644
> --- a/net/ipv6/exthdrs.c
> +++ b/net/ipv6/exthdrs.c
> @@ -499,6 +499,10 @@ static int ipv6_rpl_srh_rcv(struct sk_buff *skb)
>         u32 r;
>
>         idev = __in6_dev_get(skb->dev);
> +       if (!idev) {
> +               kfree_skb(skb);

I suggest:

kfree_skb_reason(skb, SKB_DROP_REASON_IPV6DISABLED)

Re: [PATCH net] ipv6: rpl: add NULL check for idev in ipv6_rpl_srh_rcv()

[Andrea Mayer]

On Tue, 28 Apr 2026 17:24:05 -0700
Eric Dumazet <edumazet@google.com> wrote:

> On Tue, Apr 28, 2026 at 3:48 PM Andrea Mayer <andrea.mayer@uniroma2.it> wrote:
> > [snip]
> > diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
> > index 03cbce842c1a..e398a8851031 100644
> > --- a/net/ipv6/exthdrs.c
> > +++ b/net/ipv6/exthdrs.c
> > @@ -499,6 +499,10 @@ static int ipv6_rpl_srh_rcv(struct sk_buff *skb)
> >         u32 r;
> >
> >         idev = __in6_dev_get(skb->dev);
> > +       if (!idev) {
> > +               kfree_skb(skb);
> 
> I suggest:
> 
> kfree_skb_reason(skb, SKB_DROP_REASON_IPV6DISABLED)

Hi Eric,

Thanks for the suggestion. I will include it in v2.

Andrea