From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3111D48E0C3 for ; Tue, 8 Sep 2026 19:28:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788895731; cv=none; b=EA6rYvb6m2IMrHiXbQ1LRwXntULSDsY1igqwmhWUIBG/Mac5KCrh4Te89yUwbG+4ZQEx6VESBNuWuGBHvYbOvNqxl5QOccI9rUPoOETgRylU0Pji179bxySQ2g4XmR50KWGT7kaxw2aMtXxj2bEYTUaZ782t0ONLwJ0EGZzaX8M= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788895731; c=relaxed/simple; bh=FNN81jhznOf5dCPnxtAl5ESEIO1tdfrM8iDtg51A+Hw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=GFmVw5RmETIQBXsecxDiuz4Bo0Ixs2g0EoMk8fD3mXZy6M1RGuP9lEX96R0iNFzGiXgh8S3w56QP5nV+Jf4PHTEPYWl5QiSbPum7a+mndorFGM9JMTeUmGkm4sw94TpZm2D4ItfQWlYVep+AKrWOOXgpbJxF+Ua8XpQ8H9CB6ZM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=FgMm5zLl; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="FgMm5zLl" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 173371F00A3A; Tue, 8 Sep 2026 19:28:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788895720; bh=OnCRGoJU6nqQq3eEQ5UwUB/EAA7x3By0g0YL8dGT8WY=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=FgMm5zLloFjO99++EUsesCxCZ3QWDM75jbjHF/6eBm3VPGaPx10HW3QeXuoD2S3L9 hhuPz97QcKimG3OuCuOUfMz9EeVq+4SJhrrZ7utoDqJRWYg/hSA1BwtAZXB35GfwM9 Q2CId0lAV5htnkPB2ZadnFntzJ7bFktOn7qwCSAZj0L/wa+I73hCLOhELFozWspxaW 9nlotT+QbyP2Q/gdWDwmz8iNrHuPoS8Y0PZXP6cKen/QmVd7GFH2/wU+g9U2uh8SYY nQjscasA6DuyO0COT/aSsy3tiDu75cPOfZK2fCNl5fk362FngEjg7JUWeDAYj55ChE +ZTebYQ/P+L4A== From: Sasha Levin To: stable@vger.kernel.org Cc: Andrea Mayer , Xiang Mei , Simon Horman , Jakub Kicinski , Sasha Levin Subject: [PATCH 6.1.y] ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv() Date: Tue, 8 Sep 2026 15:28:38 -0400 Message-ID: <20260908192838.297280-1-sashal@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <2026090350-camcorder-skillful-ef4f@gregkh> References: <2026090350-camcorder-skillful-ef4f@gregkh> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Andrea Mayer [ Upstream commit f826df95332c07380206dbd54178b6eefb311aba ] ipv6_rpl_srh_rcv() dereferences idev from __in6_dev_get() without a NULL check when reading idev->cnf.rpl_seg_enabled. When the device's MTU drops below IPV6_MIN_MTU, addrconf_ifdown() clears dev->ip6_ptr through RCU_INIT_POINTER(). A packet that passed the idev check in ip6_rcv_core() can then reach ipv6_rpl_srh_rcv() with dev->ip6_ptr already NULL. Reproduced by flooding the receiving interface with ping6 traffic while flapping its MTU between 1500 and 1200: BUG: KASAN: null-ptr-deref in ipv6_rpl_srh_rcv+0xb3/0x1070 Read of size 4 at addr 00000000000006b4 by task ping6/394 CPU: 2 UID: 0 PID: 394 Comm: ping6 Not tainted 7.2.0-rc7-micro-vm-dev-00095-g24ef02f934ee #240 PREEMPT(full) Call Trace: kasan_report+0xc6/0x100 ipv6_rpl_srh_rcv+0xb3/0x1070 ip6_protocol_deliver_rcu+0x759/0x9a0 ip6_input_finish+0xa8/0x1b0 ip6_input+0xe1/0x490 ipv6_rcv+0x33d/0x460 __netif_receive_skb_one_core+0xd6/0x130 process_backlog+0x2cc/0xa00 __napi_poll.constprop.0+0x56/0x270 net_rx_action+0x327/0x730 handle_softirqs+0x11e/0x630 do_softirq+0xb3/0xf0 Both ipv6_rpl_srh_rcv() and ipv6_srh_rcv() are called only from ipv6_rthdr_rcv(), which already has an idev lookup. Fix the NULL dereference on the RPL path by checking idev in ipv6_rthdr_rcv(), before it calls either function. The callees take idev as an argument and no longer call __in6_dev_get(), so the packet is now dropped in one place, with SKB_DROP_REASON_IPV6DISABLED on both paths. Fixes: 8610c7c6e3bd ("net: ipv6: add support for rpl sr exthdr") Cc: stable@vger.kernel.org Signed-off-by: Andrea Mayer Tested-by: Xiang Mei Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260817132644.2223-1-andrea.mayer@uniroma2.it Signed-off-by: Jakub Kicinski [ adapted configuration reads to the existing explicit comparison logic while passing the existing idev pointer to handlers ] Signed-off-by: Sasha Levin --- net/ipv6/exthdrs.c | 26 ++++++++++++-------------- 1 file changed, 12 insertions(+), 14 deletions(-) diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c index 823d405069b7d..e3210d3662a04 100644 --- a/net/ipv6/exthdrs.c +++ b/net/ipv6/exthdrs.c @@ -373,23 +373,16 @@ static void seg6_update_csum(struct sk_buff *skb) (__be32 *)addr); } -static int ipv6_srh_rcv(struct sk_buff *skb) +static int ipv6_srh_rcv(struct sk_buff *skb, struct inet6_dev *idev) { struct inet6_skb_parm *opt = IP6CB(skb); struct net *net = dev_net(skb->dev); struct ipv6_sr_hdr *hdr; - struct inet6_dev *idev; struct in6_addr *addr; int accept_seg6; hdr = (struct ipv6_sr_hdr *)skb_transport_header(skb); - idev = __in6_dev_get(skb->dev); - if (!idev) { - kfree_skb(skb); - return -1; - } - accept_seg6 = net->ipv6.devconf_all->seg6_enabled; if (accept_seg6 > idev->cnf.seg6_enabled) accept_seg6 = idev->cnf.seg6_enabled; @@ -497,12 +490,11 @@ static int ipv6_srh_rcv(struct sk_buff *skb) return -1; } -static int ipv6_rpl_srh_rcv(struct sk_buff *skb) +static int ipv6_rpl_srh_rcv(struct sk_buff *skb, struct inet6_dev *idev) { struct ipv6_rpl_sr_hdr *hdr, *ohdr, *chdr; struct inet6_skb_parm *opt = IP6CB(skb); struct net *net = dev_net(skb->dev); - struct inet6_dev *idev; struct ipv6hdr *oldhdr; unsigned int chdr_len; unsigned char *buf; @@ -511,8 +503,6 @@ static int ipv6_rpl_srh_rcv(struct sk_buff *skb) u64 n = 0; u32 r; - idev = __in6_dev_get(skb->dev); - accept_rpl_seg = net->ipv6.devconf_all->rpl_seg_enabled; if (accept_rpl_seg > idev->cnf.rpl_seg_enabled) accept_rpl_seg = idev->cnf.rpl_seg_enabled; @@ -719,10 +709,14 @@ static int ipv6_rthdr_rcv(struct sk_buff *skb) switch (hdr->type) { case IPV6_SRCRT_TYPE_4: /* segment routing */ - return ipv6_srh_rcv(skb); + if (!idev) + goto disabled; + return ipv6_srh_rcv(skb, idev); case IPV6_SRCRT_TYPE_3: /* rpl segment routing */ - return ipv6_rpl_srh_rcv(skb); + if (!idev) + goto disabled; + return ipv6_rpl_srh_rcv(skb, idev); default: break; } @@ -870,6 +864,10 @@ static int ipv6_rthdr_rcv(struct sk_buff *skb) icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, (&hdr->type) - skb_network_header(skb)); return -1; + +disabled: + kfree_skb_reason(skb, SKB_DROP_REASON_IPV6DISABLED); + return -1; } static const struct inet6_protocol rthdr_protocol = { -- 2.53.0