Re: [PATCH net] ipv6: null-check fib6_node before accessing in __ip6_del_rt_siblings()

[Ido Schimmel <idosch@nvidia.com>]

On Fri, Sep 04, 2026 at 06:06:44PM +0000, Naman Gulati wrote:
> syzbot reported a null-ptr-deref in __ip6_del_rt_siblings() [0].
> 
> The stack trace hinted towards a null dereference of rt->fib6_node when
> fn->leaf is accessed in __ip6_del_rt_siblings(). With
> RTNL_FLAG_DOIT_UNLOCKED set, inet6_rtm_delroute() operations run
> concurrently without acquiring the RTNL lock. In ip6_route_del(), the
> route lookup happens under rcu_read_lock() without acquiring
> table->tb6_lock.
> 
> Between ip6_route_del() looking up the route and __ip6_del_rt_siblings()
> acquiring table->tb6_lock, another thread can modify the routing table.
> For example, when an ECMP route is replaced via RTM_NEWROUTE with
> NLM_F_REPLACE, fib6_add_rt2node() unlinks all old siblings and sets
> iter->fib6_node = NULL. A reproducer was found that triggers this [1].
> 
> Add a check to ensure rt->fib6_node is non-null before accessing it.

[...]

> Fixes: bd11ff421d36 ("ipv6: Get rid of RTNL for SIOCDELRT and RTM_DELROUTE.")
> Reported-by: syzbot+a73e5ee0fd534fed75bd@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/netdev/6a9b03f9.04649fcc.10325f.0003.GAE@google.com
> Signed-off-by: Naman Gulati <namangulati@google.com>
> Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>

Reviewed-by: Ido Schimmel <idosch@nvidia.com>

Sashiko-gemini flagged a pre-existing and unrelated issue that looks
valid. I will check it.