* [PATCH net v2] rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled
@ 2026-07-09 16:27 Ilia Gavrilov
2026-07-10 4:47 ` Allison Henderson
0 siblings, 1 reply; 2+ messages in thread
From: Ilia Gavrilov @ 2026-07-09 16:27 UTC (permalink / raw)
To: Allison Henderson
Cc: David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Ka-Cheong Poon, Santosh Shilimkar,
netdev@vger.kernel.org, linux-rdma@vger.kernel.org,
rds-devel@oss.oracle.com, linux-kernel@vger.kernel.org,
lvc-project@linuxtesting.org
When booting with the 'ipv6.disable=1' parameter, inet6_addr_lst
is never initialized because inet6_init() exits before addrconf_init()
is called to initialize it. An attempt to bind an RDS socket to
an ipv6 address results in a crash in __ipv6_chk_addr_and_flags()
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
RIP: 0010:__ipv6_chk_addr_and_flags+0x1df/0x7e0
Call Trace:
<TASK>
ipv6_chk_addr+0x3b/0x50
rds_tcp_laddr_check+0x155/0x3b0 [rds_tcp]
rds_trans_get_preferred+0x15d/0x2d0 [rds]
? trace_hardirqs_on+0x2d/0x110
rds_bind+0x1433/0x1d60 [rds]
? rds_remove_bound+0xd50/0xd50 [rds]
? aa_af_perm+0x250/0x250
? __might_fault+0xde/0x190
? __sys_bind+0x1dc/0x210
__sys_bind+0x1dc/0x210
? __ia32_sys_socketpair+0x100/0x100
? restore_fpregs_from_fpstate+0x53/0x100
__x64_sys_bind+0x73/0xb0
? syscall_enter_from_user_mode+0x1c/0x50
do_syscall_64+0x34/0x80
entry_SYSCALL_64_after_hwframe+0x6e/0xd8
RIP: 0033:0x7f47f8269ea9
</TASK>
The following code reproduces the issue:
struct sockaddr_in6 addr;
s = socket(PF_RDS, SOCK_SEQPACKET, 0);
memset(&addr, 0, sizeof(addr));
inet_pton(AF_INET6, ADDRESS, &addr.sin6_addr);
addr.sin6_family = AF_INET6;
addr.sin6_port = htons(PORT);
bind(s, &addr, sizeof(addr));
Found by InfoTeCS on behalf of Linux Verification Center
(linuxtesting.org) with Syzkaller.
Fixes: eee2fa6ab322 ("rds: Changing IP address internal representation to struct in6_addr")
Fixes: 1e2b44e78eea ("rds: Enable RDS IPv6 support")
Signed-off-by: Ilia Gavrilov <Ilia.Gavrilov@infotecs.ru>
---
v2: Add a similar check for inbound link-local IPv6 connects
net/rds/ib.c | 4 ++++
net/rds/ib_cm.c | 4 ++++
net/rds/tcp.c | 8 +++++---
3 files changed, 13 insertions(+), 3 deletions(-)
diff --git a/net/rds/ib.c b/net/rds/ib.c
index 39f87272e071..8f9cf491984f 100644
--- a/net/rds/ib.c
+++ b/net/rds/ib.c
@@ -429,6 +429,10 @@ static int rds_ib_laddr_check_cm(struct net *net, const struct in6_addr *addr,
sa = (struct sockaddr *)&sin;
} else {
#if IS_ENABLED(CONFIG_IPV6)
+ if (!ipv6_mod_enabled()) {
+ ret = -EADDRNOTAVAIL;
+ goto out;
+ }
memset(&sin6, 0, sizeof(sin6));
sin6.sin6_family = AF_INET6;
sin6.sin6_addr = *addr;
diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c
index 5667f0173b47..d46146887ba4 100644
--- a/net/rds/ib_cm.c
+++ b/net/rds/ib_cm.c
@@ -810,6 +810,10 @@ int rds_ib_cm_handle_connect(struct rdma_cm_id *cm_id,
dp = event->param.conn.private_data;
if (isv6) {
#if IS_ENABLED(CONFIG_IPV6)
+ if (!ipv6_mod_enabled()) {
+ err = -EOPNOTSUPP;
+ goto out;
+ }
dp_cmn = &dp->ricp_v6.dp_cmn;
saddr6 = &dp->ricp_v6.dp_saddr;
daddr6 = &dp->ricp_v6.dp_daddr;
diff --git a/net/rds/tcp.c b/net/rds/tcp.c
index a1de114d5e2e..955d92277d5a 100644
--- a/net/rds/tcp.c
+++ b/net/rds/tcp.c
@@ -366,9 +366,11 @@ int rds_tcp_laddr_check(struct net *net, const struct in6_addr *addr,
rcu_read_unlock();
}
#if IS_ENABLED(CONFIG_IPV6)
- ret = ipv6_chk_addr(net, addr, dev, 0);
- if (ret)
- return 0;
+ if (ipv6_mod_enabled()) {
+ ret = ipv6_chk_addr(net, addr, dev, 0);
+ if (ret)
+ return 0;
+ }
#endif
return -EADDRNOTAVAIL;
}
--
2.47.3
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH net v2] rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled
2026-07-09 16:27 [PATCH net v2] rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled Ilia Gavrilov
@ 2026-07-10 4:47 ` Allison Henderson
0 siblings, 0 replies; 2+ messages in thread
From: Allison Henderson @ 2026-07-10 4:47 UTC (permalink / raw)
To: Ilia Gavrilov
Cc: David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Ka-Cheong Poon, Santosh Shilimkar,
netdev@vger.kernel.org, linux-rdma@vger.kernel.org,
rds-devel@oss.oracle.com, linux-kernel@vger.kernel.org,
lvc-project@linuxtesting.org
On Thu, 2026-07-09 at 16:27 +0000, Ilia Gavrilov wrote:
> When booting with the 'ipv6.disable=1' parameter, inet6_addr_lst
> is never initialized because inet6_init() exits before addrconf_init()
> is called to initialize it. An attempt to bind an RDS socket to
> an ipv6 address results in a crash in __ipv6_chk_addr_and_flags()
>
> KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
> RIP: 0010:__ipv6_chk_addr_and_flags+0x1df/0x7e0
> Call Trace:
> <TASK>
> ipv6_chk_addr+0x3b/0x50
> rds_tcp_laddr_check+0x155/0x3b0 [rds_tcp]
> rds_trans_get_preferred+0x15d/0x2d0 [rds]
> ? trace_hardirqs_on+0x2d/0x110
> rds_bind+0x1433/0x1d60 [rds]
> ? rds_remove_bound+0xd50/0xd50 [rds]
> ? aa_af_perm+0x250/0x250
> ? __might_fault+0xde/0x190
> ? __sys_bind+0x1dc/0x210
> __sys_bind+0x1dc/0x210
> ? __ia32_sys_socketpair+0x100/0x100
> ? restore_fpregs_from_fpstate+0x53/0x100
> __x64_sys_bind+0x73/0xb0
> ? syscall_enter_from_user_mode+0x1c/0x50
> do_syscall_64+0x34/0x80
> entry_SYSCALL_64_after_hwframe+0x6e/0xd8
> RIP: 0033:0x7f47f8269ea9
> </TASK>
>
> The following code reproduces the issue:
>
> struct sockaddr_in6 addr;
> s = socket(PF_RDS, SOCK_SEQPACKET, 0);
>
> memset(&addr, 0, sizeof(addr));
> inet_pton(AF_INET6, ADDRESS, &addr.sin6_addr);
> addr.sin6_family = AF_INET6;
> addr.sin6_port = htons(PORT);
>
> bind(s, &addr, sizeof(addr));
>
> Found by InfoTeCS on behalf of Linux Verification Center
> (linuxtesting.org) with Syzkaller.
>
> Fixes: eee2fa6ab322 ("rds: Changing IP address internal representation to struct in6_addr")
> Fixes: 1e2b44e78eea ("rds: Enable RDS IPv6 support")
> Signed-off-by: Ilia Gavrilov <Ilia.Gavrilov@infotecs.ru>
This looks good to me, thanks for the quick response.
Reviewed-by: Allison Henderson <achender@kernel.org>
> ---
> v2: Add a similar check for inbound link-local IPv6 connects
>
> net/rds/ib.c | 4 ++++
> net/rds/ib_cm.c | 4 ++++
> net/rds/tcp.c | 8 +++++---
> 3 files changed, 13 insertions(+), 3 deletions(-)
>
> diff --git a/net/rds/ib.c b/net/rds/ib.c
> index 39f87272e071..8f9cf491984f 100644
> --- a/net/rds/ib.c
> +++ b/net/rds/ib.c
> @@ -429,6 +429,10 @@ static int rds_ib_laddr_check_cm(struct net *net, const struct in6_addr *addr,
> sa = (struct sockaddr *)&sin;
> } else {
> #if IS_ENABLED(CONFIG_IPV6)
> + if (!ipv6_mod_enabled()) {
> + ret = -EADDRNOTAVAIL;
> + goto out;
> + }
> memset(&sin6, 0, sizeof(sin6));
> sin6.sin6_family = AF_INET6;
> sin6.sin6_addr = *addr;
> diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c
> index 5667f0173b47..d46146887ba4 100644
> --- a/net/rds/ib_cm.c
> +++ b/net/rds/ib_cm.c
> @@ -810,6 +810,10 @@ int rds_ib_cm_handle_connect(struct rdma_cm_id *cm_id,
> dp = event->param.conn.private_data;
> if (isv6) {
> #if IS_ENABLED(CONFIG_IPV6)
> + if (!ipv6_mod_enabled()) {
> + err = -EOPNOTSUPP;
> + goto out;
> + }
> dp_cmn = &dp->ricp_v6.dp_cmn;
> saddr6 = &dp->ricp_v6.dp_saddr;
> daddr6 = &dp->ricp_v6.dp_daddr;
> diff --git a/net/rds/tcp.c b/net/rds/tcp.c
> index a1de114d5e2e..955d92277d5a 100644
> --- a/net/rds/tcp.c
> +++ b/net/rds/tcp.c
> @@ -366,9 +366,11 @@ int rds_tcp_laddr_check(struct net *net, const struct in6_addr *addr,
> rcu_read_unlock();
> }
> #if IS_ENABLED(CONFIG_IPV6)
> - ret = ipv6_chk_addr(net, addr, dev, 0);
> - if (ret)
> - return 0;
> + if (ipv6_mod_enabled()) {
> + ret = ipv6_chk_addr(net, addr, dev, 0);
> + if (ret)
> + return 0;
> + }
> #endif
> return -EADDRNOTAVAIL;
> }
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-07-10 4:47 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-09 16:27 [PATCH net v2] rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled Ilia Gavrilov
2026-07-10 4:47 ` Allison Henderson
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox