Re: [PATCH net] vxlan: fix NULL deref when joining a group without a socket

[Fernando Fernandez Mancera <fmancera@suse.de>]

On 9/30/26 8:03 AM, Jiri Benc wrote:
> On Tue, 29 Sep 2026 17:27:01 +0200, Fernando Fernandez Mancera wrote:
>> On 9/29/26 2:22 PM, Wentao Luo wrote:
>>> vxlan_sock_add() ignores -EAFNOSUPPORT when creating the IPv6 socket
>>> of a metadata device, so the device can come up with vn6_sock NULL
>>> after ipv6.disable=1. A later IPv6 multicast join still uses that
>>> socket. vxlan_igmp_join() dereferences it and oopses.
>>>
>>> This was observed on an external vnifilter device by adding an IPv6
>>> group while the device was up:
>>>
>>>     BUG: KASAN: null-ptr-deref in vxlan_igmp_join+0xb8/0x18c
>>>     Read of size 8 at addr 0000000000000010 by task bridge/729
>>>     Call trace:
>>>      show_stack+0x18/0x24 (C)
>>>      dump_stack_lvl+0x78/0x90
>>>      print_report+0x468/0x5cc
>>>      kasan_report+0xa4/0xf0
>>>      __asan_load8+0x7c/0xd0
>>>      vxlan_igmp_join+0xb8/0x18c
>>>      vxlan_vni_update_group+0x2b4/0x390
>>>      vxlan_process_vni_filter+0xfe0/0x1750
>>>      vxlan_vnifilter_process+0x218/0x270
>>>      rtnetlink_rcv_msg+0x1ec/0x514
>>>      netlink_rcv_skb+0xc0/0x1f0
>>>      rtnetlink_rcv+0x18/0x24
>>>      netlink_unicast+0x4b8/0x558
>>>      netlink_sendmsg+0x2b8/0x584
>>>      ...
>>>
>>> Return -EAFNOSUPPORT from vxlan_igmp_join() and vxlan_igmp_leave()
>>> when the address family has no socket. The same leave path runs while
>>> rolling back a failed join.
>>>
>>> Fixes: d074bf960044 ("vxlan: correctly handle ipv6.disable module
>>> parameter")
> 
> While I've introduced my share of bugs over the years, this one is not
> introduced by my commit. Commit d074bf960044 specifically checks for
> the metadata mode and leaves the ipv6 socket as NULL only in the
> metadata mode. In the metadata mode, there's no multicast and the
> vxlan_igmp_* functions are never reached. This was introduced by a
> different commit.
> 
> With the current commit message:
> 
> Nacked-by: Jiri Benc <jbenc@redhat.com>
> 
> Please find the real cause, fix the Fixes header and resubmit.
> 

That is fair, thanks Jiri. I didn't realize when commit d074bf960044 was 
written, metadata mode did not support multicast. It seems the real 
Fixes header should be:

Fixes: f9c4bb0b245c ("vxlan: vni filtering support on collect metadata 
device")

This commit introduced the multicast support for metadata mode and 
missed the NULL check.

> Thanks,
> 
>   Jiri