Commit 06413793 authored by Minhong He's avatar Minhong He Committed by Jakub Kicinski
Browse files

ipv6: add NULL checks for idev in SRv6 paths 



__in6_dev_get() can return NULL when the device has no IPv6 configuration
(e.g. MTU < IPV6_MIN_MTU or after NETDEV_UNREGISTER).

Add NULL checks for idev returned by __in6_dev_get() in both
seg6_hmac_validate_skb() and ipv6_srh_rcv() to prevent potential NULL
pointer dereferences.

Fixes: 1ababeba ("ipv6: implement dataplane support for rthdr type 4 (Segment Routing Header)")
Fixes: bf355b8d ("ipv6: sr: add core files for SR HMAC support")
Signed-off-by: default avatarMinhong He <heminhong@kylinos.cn>
Reviewed-by: default avatarAndrea Mayer <andrea.mayer@uniroma2.it>
Link: https://patch.msgid.link/20260316073301.106643-1-heminhong@kylinos.cn


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 55dc632a

net/ipv6/exthdrs.c

+4 −0
Original line number Diff line number Diff line
@@ -379,6 +379,10 @@ static int ipv6_srh_rcv(struct sk_buff *skb) 
	hdr = (struct ipv6_sr_hdr *)skb_transport_header(skb);



	idev = __in6_dev_get(skb->dev);

	if (!idev) {

		kfree_skb(skb);

		return -1;

	}



	accept_seg6 = min(READ_ONCE(net->ipv6.devconf_all->seg6_enabled),

			  READ_ONCE(idev->cnf.seg6_enabled));

net/ipv6/seg6_hmac.c

+2 −0
Original line number Diff line number Diff line
@@ -184,6 +184,8 @@ bool seg6_hmac_validate_skb(struct sk_buff *skb) 
	int require_hmac;



	idev = __in6_dev_get(skb->dev);

	if (!idev)

		return false;



	srh = (struct ipv6_sr_hdr *)skb_transport_header(skb);