Re: [PATCH net] ipv6: rpl: add NULL check for idev in ipv6_rpl_srh_rcv()

[Justin Iurman <justin.iurman@gmail.com>]

On 5/15/26 14:55, Weiming Shi wrote:
> ipv6_rpl_srh_rcv() calls __in6_dev_get(skb->dev) and dereferences the
> result without a NULL check.  When addrconf_ifdown() concurrently clears
> dev->ip6_ptr via RCU_INIT_POINTER(dev->ip6_ptr, NULL), __in6_dev_get()
> returns NULL and the subsequent READ_ONCE(idev->cnf.rpl_seg_enabled)
> triggers a NULL pointer dereference.
> 
>   BUG: kernel NULL pointer dereference, address: 0000000000000370
>   Oops: Oops: 0000 [#1] SMP NOPTI
>   RIP: 0010:ipv6_rthdr_rcv+0x3bf/0xe70
>    ipv6_rpl_srh_rcv (net/ipv6/exthdrs.c:504)
>    ipv6_rthdr_rcv (net/ipv6/exthdrs.c:691)
>    ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:478)
>    ip6_input_finish (net/ipv6/ip6_input.c:532)
>    ip6_input (net/ipv6/ip6_input.c:540)
> 
> Add a NULL check for idev, dropping the packet when the device has no
> IPv6 configuration.
> 
> Fixes: 8610c7c6e3bd ("net: ipv6: add support for rpl sr exthdr")
> Reported-by: Xiang Mei <xmei5@asu.edu>
> Signed-off-by: Weiming Shi <bestswngs@gmail.com>
> ---
>   net/ipv6/exthdrs.c | 4 ++++
>   1 file changed, 4 insertions(+)
> 
> diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
> index 95558fd6f447..19002e551a03 100644
> --- a/net/ipv6/exthdrs.c
> +++ b/net/ipv6/exthdrs.c
> @@ -498,6 +498,10 @@ static int ipv6_rpl_srh_rcv(struct sk_buff *skb)
>   	u32 r;
> 
>   	idev = __in6_dev_get(skb->dev);
> +	if (!idev) {
> +		kfree_skb(skb);
> +		return -1;
> +	}
> 
>   	accept_rpl_seg = min(READ_ONCE(net->ipv6.devconf_all->rpl_seg_enabled),
>   			     READ_ONCE(idev->cnf.rpl_seg_enabled));
> --
> 2.43.0

The fix is correct, but this is a duplicate of Andrea's patch (see [1]) 
where Eric suggested to use kfree_skb_reason() with 
SKB_DROP_REASON_IPV6DISABLED. Based on the above, I don't think this 
patch should be accepted.

  [1] 
https://lore.kernel.org/netdev/20260428224816.11223-1-andrea.mayer@uniroma2.it/