ipv6: guard against possible NULL deref in __in6_dev_stats_get()

dev_get_by_index_rcu() could return NULL if the original physical
device is unregistered.

Found by Sashiko.

Fixes: e1ae5c2ea478 ("vrf: Increment Icmp6InMsgs on the original netdev")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Stephen Suryaputra <ssuryaextr@gmail.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260526145529.3587126-2-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index 9e96776945e5f67f2bf2293c24975e6d6064aeda..539bbbe54b14e8108ff7304d7a08bc605655cc31 100644 (file)
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -369,8 +369,11 @@ static inline struct inet6_dev *__in6_dev_get_rtnl_net(const struct net_device *
 static inline struct inet6_dev *__in6_dev_stats_get(const struct net_device *dev,
                                                    const struct sk_buff *skb)
 {
-       if (netif_is_l3_master(dev))
+       if (netif_is_l3_master(dev)) {
                dev = dev_get_by_index_rcu(dev_net(dev), inet6_iif(skb));
+               if (!dev)
+                       return NULL;
+       }
        return __in6_dev_get(dev);
 }