Re: [PATCH net] ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()

[David Ahern <dsahern@kernel.org>]

On 3/1/26 12:45 PM, Jakub Kicinski wrote:
> l3mdev_master_dev_rcu() can return NULL when the slave device is being
> un-slaved from a VRF. All other callers deal with this, but we lost
> the fallback to loopback in ip6_rt_pcpu_alloc() -> ip6_rt_get_dev_rcu()
> with commit 4832c30d5458 ("net: ipv6: put host and anycast routes on
> device with address").
> 
>   KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f]
>   RIP: 0010:ip6_rt_pcpu_alloc (net/ipv6/route.c:1418)
>   Call Trace:
>    ip6_pol_route (net/ipv6/route.c:2318)
>    fib6_rule_lookup (net/ipv6/fib6_rules.c:115)
>    ip6_route_output_flags (net/ipv6/route.c:2607)
>    vrf_process_v6_outbound (drivers/net/vrf.c:437)
> 
> I was tempted to rework the un-slaving code to clear the flag first
> and insert synchronize_rcu() before we remove the upper. But looks like
> the explicit fallback to loopback_dev is an established pattern.
> And I guess avoiding the synchronize_rcu() is nice, too.
> 
> Fixes: 4832c30d5458 ("net: ipv6: put host and anycast routes on device with address")
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> ---
> now that NIPA is not full of the tc-action.sh crashes this 1 in ~30 runs
> crash in fcnal_ipv6.sh pops out quite clearly.
> 
> CC: dsahern@kernel.org
> ---
>  net/ipv6/route.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 

Reviewed-by: David Ahern <dsahern@kernel.org>