ipv6_rpl_srh_rcv() dereferences idev from __in6_dev_get() without a
NULL check when reading idev->cnf.rpl_seg_enabled.
When the device's MTU drops below IPV6_MIN_MTU, addrconf_ifdown()
clears dev->ip6_ptr through RCU_INIT_POINTER(), which is immediately
visible to concurrent readers. A packet that already passed the idev
check in ip6_rcv_core() can race with this and hit a NULL pointer
dereference.
Reproduced by flooding traffic while rapidly flapping the receiving
interface's MTU between 1500 and 1200:
BUG: KASAN: null-ptr-deref in ipv6_rpl_srh_rcv+0xae/0x1050
Read of size 4 at addr 00000000000006b4 by task ping6/386
CPU: 0 UID: 0 PID: 386 Comm: ping6 Not tainted 7.1.0-rc3 #114 PREEMPT(full)
Call Trace:
kasan_report+0xc6/0x100
ipv6_rpl_srh_rcv+0xae/0x1050
ip6_protocol_deliver_rcu+0x754/0x9a0
ip6_input_finish+0xa3/0x1b0
ip6_input+0xdc/0x490
ipv6_rcv+0x338/0x460
__netif_receive_skb_one_core+0xd1/0x130
process_backlog+0x2c7/0x9f0
__napi_poll.constprop.0+0x51/0x270
net_rx_action+0x322/0x730
handle_softirqs+0x119/0x640
do_softirq+0xae/0xe0
Add a NULL check for idev after __in6_dev_get(), dropping the skb
with SKB_DROP_REASON_IPV6DISABLED when the device has no IPv6
configuration.
Fixes: 8610c7c6e3bd ("net: ipv6: add support for rpl sr exthdr")
Cc: stable@vger.kernel.org
Signed-off-by: Andrea Mayer
---
v2:
- use SKB_DROP_REASON_IPV6DISABLED as drop reason (Eric Dumazet)
v1: https://lore.kernel.org/netdev/20260428224816.11223-1-andrea.mayer@uniroma2.it/
---
net/ipv6/exthdrs.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index 03cbce842c1a..a4af6e63349c 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -499,6 +499,10 @@ static int ipv6_rpl_srh_rcv(struct sk_buff *skb)
u32 r;
idev = __in6_dev_get(skb->dev);
+ if (!idev) {
+ kfree_skb_reason(skb, SKB_DROP_REASON_IPV6DISABLED);
+ return -1;
+ }
accept_rpl_seg = min(READ_ONCE(net->ipv6.devconf_all->rpl_seg_enabled),
READ_ONCE(idev->cnf.rpl_seg_enabled));
--
2.43.0