Re: [PATCH net v2] vxlan: fix NULL vn6_sock dereference in vxlan_igmp_join() and vxlan_igmp_leave()

[Weiming Shi <bestswngs@gmail.com>]

On 26-04-18 18:58, Ido Schimmel wrote:
> On Sat, Apr 18, 2026 at 04:41:12AM -0700, Weiming Shi wrote:
> > vxlan_sock_add() tolerates IPv6 socket creation failure with
> > -EAFNOSUPPORT (e.g. ipv6.disable=1), leaving vn6_sock as NULL while
> > successfully creating vn4_sock. vxlan_igmp_join() and
> > vxlan_igmp_leave() then crash when they dereference the NULL vn6_sock
> > for VNI filter entries with IPv6 multicast groups:
> > 
> >  Oops: general protection fault, probably for non-canonical address
> >       0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI
> >  KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
> >  RIP: 0010:vxlan_igmp_join (drivers/net/vxlan/vxlan_multicast.c:40)
> >  Call Trace:
> >   vxlan_multicast_join (drivers/net/vxlan/vxlan_multicast.c:195)
> >   vxlan_open (drivers/net/vxlan/vxlan_core.c:2965)
> >   __dev_open (net/core/dev.c:1704)
> >   __dev_change_flags (net/core/dev.c:9781)
> >   do_setlink.isra.0 (net/core/rtnetlink.c:3180)
> >   rtnl_newlink (net/core/rtnetlink.c:4238)
> >   rtnetlink_rcv_msg (net/core/rtnetlink.c:6921)
> > 
> > Skip the IPv6 multicast join/leave when vn6_sock is NULL, consistent
> > with how vxlan_sock_add() tolerates missing IPv6 support.
> > 
> > Fixes: f9c4bb0b245c ("vxlan: vni filtering support on collect metadata device")
> > Reported-by: Xiang Mei <xmei5@asu.edu>
> > Signed-off-by: Weiming Shi <bestswngs@gmail.com>
> 
> AFAICT, this is the same patch as:
> 
> https://lore.kernel.org/netdev/20260323095544.3311285-4-bestswngs@gmail.com/
> 
> If you disagree with the feedback, then please comment there instead of
> reposting the patch.
> 
Apologies for the duplicate posting - I should have followed up on the
original.

Thanks,
Weiming Shi
> > ---
> > v2:
> >   - drop sock4 NULL checks 
> > 
> >  drivers/net/vxlan/vxlan_multicast.c | 6 ++++++
> >  1 file changed, 6 insertions(+)
> > 
> > diff --git a/drivers/net/vxlan/vxlan_multicast.c b/drivers/net/vxlan/vxlan_multicast.c
> > index a7f2d67dc61b..e6aa5ab1c939 100644
> > --- a/drivers/net/vxlan/vxlan_multicast.c
> > +++ b/drivers/net/vxlan/vxlan_multicast.c
> > @@ -37,6 +37,9 @@ int vxlan_igmp_join(struct vxlan_dev *vxlan, union vxlan_addr *rip,
> >  	} else {
> >  		struct vxlan_sock *sock6 = rtnl_dereference(vxlan->vn6_sock);
> >  
> > +		if (!sock6)
> > +			return 0;
> > +
> >  		sk = sock6->sock->sk;
> >  		lock_sock(sk);
> >  		ret = ipv6_stub->ipv6_sock_mc_join(sk, ifindex,
> 
> This line changed in commit 29ae61b2fe7e ("drivers: net: drop ipv6_stub
> usage and use direct function calls")
> 
> > @@ -71,6 +74,9 @@ int vxlan_igmp_leave(struct vxlan_dev *vxlan, union vxlan_addr *rip,
> >  	} else {
> >  		struct vxlan_sock *sock6 = rtnl_dereference(vxlan->vn6_sock);
> >  
> > +		if (!sock6)
> > +			return 0;
> > +
> >  		sk = sock6->sock->sk;
> >  		lock_sock(sk);
> >  		ret = ipv6_stub->ipv6_sock_mc_drop(sk, ifindex,
> > -- 
> > 2.43.0
> >