]> git.ipfire.org Git - thirdparty/linux.git/commit
ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()
authorJustin Iurman <justin.iurman@gmail.com>
Sun, 17 May 2026 18:30:59 +0000 (20:30 +0200)
committerJakub Kicinski <kuba@kernel.org>
Wed, 20 May 2026 01:46:44 +0000 (18:46 -0700)
commitd4ea0dfd75011b78cebf3808f98ac4c4f51a6fb9
tree135cdcc9b099d3d575a4aef1d4e5b5e42536e419
parentd03e6124c724e6a380b4bef22e5a1cbc5ddf4cea
ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()

Reported by Sashiko:

The function ipv6_hop_ioam() accesses
__in6_dev_get(skb->dev)->cnf.ioam6_enabled without validating the returned
idev pointer. Because addrconf_ifdown() can concurrently clear dev->ip6_ptr
via RCU, __in6_dev_get() can return NULL during interface teardown, which
could cause a NULL pointer dereference when processing an IOAM Hop-by-Hop
option.

Let's add a check and use SKB_DROP_REASON_IPV6DISABLED accordingly.

Fixes: 9ee11f0fff20 ("ipv6: ioam: Data plane support for Pre-allocated Trace")
Cc: stable@vger.kernel.org
Signed-off-by: Justin Iurman <justin.iurman@gmail.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260517183059.29140-1-justin.iurman@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
net/ipv6/exthdrs.c