vxlan_sock_add() tolerates IPv6 socket creation failure with -EAFNOSUPPORT (e.g. ipv6.disable=1), leaving vn6_sock as NULL while successfully creating vn4_sock. vxlan_igmp_join() and vxlan_igmp_leave() then crash when they dereference the NULL vn6_sock for VNI filter entries with IPv6 multicast groups: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:vxlan_igmp_join (drivers/net/vxlan/vxlan_multicast.c:40) Call Trace: vxlan_multicast_join (drivers/net/vxlan/vxlan_multicast.c:195) vxlan_open (drivers/net/vxlan/vxlan_core.c:2965) __dev_open (net/core/dev.c:1704) __dev_change_flags (net/core/dev.c:9781) do_setlink.isra.0 (net/core/rtnetlink.c:3180) rtnl_newlink (net/core/rtnetlink.c:4238) rtnetlink_rcv_msg (net/core/rtnetlink.c:6921) Skip the IPv6 multicast join/leave when vn6_sock is NULL, consistent with how vxlan_sock_add() tolerates missing IPv6 support. Fixes: f9c4bb0b245c ("vxlan: vni filtering support on collect metadata device") Reported-by: Xiang Mei Signed-off-by: Weiming Shi --- v2: - drop sock4 NULL checks drivers/net/vxlan/vxlan_multicast.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/vxlan/vxlan_multicast.c b/drivers/net/vxlan/vxlan_multicast.c index a7f2d67dc61b..e6aa5ab1c939 100644 --- a/drivers/net/vxlan/vxlan_multicast.c +++ b/drivers/net/vxlan/vxlan_multicast.c @@ -37,6 +37,9 @@ int vxlan_igmp_join(struct vxlan_dev *vxlan, union vxlan_addr *rip, } else { struct vxlan_sock *sock6 = rtnl_dereference(vxlan->vn6_sock); + if (!sock6) + return 0; + sk = sock6->sock->sk; lock_sock(sk); ret = ipv6_stub->ipv6_sock_mc_join(sk, ifindex, @@ -71,6 +74,9 @@ int vxlan_igmp_leave(struct vxlan_dev *vxlan, union vxlan_addr *rip, } else { struct vxlan_sock *sock6 = rtnl_dereference(vxlan->vn6_sock); + if (!sock6) + return 0; + sk = sock6->sock->sk; lock_sock(sk); ret = ipv6_stub->ipv6_sock_mc_drop(sk, ifindex, -- 2.43.0