[PATCH net] ipv6: rpl: add NULL check for idev in ipv6_rpl_srh_rcv()

[Weiming Shi <bestswngs@gmail.com>]

ipv6_rpl_srh_rcv() calls __in6_dev_get(skb->dev) and dereferences the
result without a NULL check.  When addrconf_ifdown() concurrently clears
dev->ip6_ptr via RCU_INIT_POINTER(dev->ip6_ptr, NULL), __in6_dev_get()
returns NULL and the subsequent READ_ONCE(idev->cnf.rpl_seg_enabled)
triggers a NULL pointer dereference.

 BUG: kernel NULL pointer dereference, address: 0000000000000370
 Oops: Oops: 0000 [#1] SMP NOPTI
 RIP: 0010:ipv6_rthdr_rcv+0x3bf/0xe70
  ipv6_rpl_srh_rcv (net/ipv6/exthdrs.c:504)
  ipv6_rthdr_rcv (net/ipv6/exthdrs.c:691)
  ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:478)
  ip6_input_finish (net/ipv6/ip6_input.c:532)
  ip6_input (net/ipv6/ip6_input.c:540)

Add a NULL check for idev, dropping the packet when the device has no
IPv6 configuration.

Fixes: 8610c7c6e3bd ("net: ipv6: add support for rpl sr exthdr")
Reported-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
---
 net/ipv6/exthdrs.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index 95558fd6f447..19002e551a03 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -498,6 +498,10 @@ static int ipv6_rpl_srh_rcv(struct sk_buff *skb)
 	u32 r;

 	idev = __in6_dev_get(skb->dev);
+	if (!idev) {
+		kfree_skb(skb);
+		return -1;
+	}

 	accept_rpl_seg = min(READ_ONCE(net->ipv6.devconf_all->rpl_seg_enabled),
 			     READ_ONCE(idev->cnf.rpl_seg_enabled));
--
2.43.0