Commit aa6c6d9e authored by Weiming Shi's avatar Weiming Shi Committed by Jakub Kicinski
Browse files

bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() 



bareudp_fill_metadata_dst() passes bareudp->sock to
udp_tunnel6_dst_lookup() in the IPv6 path without a NULL check.
The socket is only created in bareudp_open() and NULLed in
bareudp_stop(), so calling this function while the device is down
triggers a NULL dereference via sock->sk.

 BUG: kernel NULL pointer dereference, address: 0000000000000018
 RIP: 0010:udp_tunnel6_dst_lookup (net/ipv6/ip6_udp_tunnel.c:160)
 Call Trace:
  <TASK>
  bareudp_fill_metadata_dst (drivers/net/bareudp.c:532)
  do_execute_actions (net/openvswitch/actions.c:901)
  ovs_execute_actions (net/openvswitch/actions.c:1589)
  ovs_packet_cmd_execute (net/openvswitch/datapath.c:700)
  genl_family_rcv_msg_doit (net/netlink/genetlink.c:1114)
  genl_rcv_msg (net/netlink/genetlink.c:1209)
  netlink_rcv_skb (net/netlink/af_netlink.c:2550)
  </TASK>

Add a NULL check returning -ESHUTDOWN, consistent with the xmit paths
in the same driver.

Fixes: 571912c6 ("net: UDP tunnel encapsulation module for tunnelling different protocols like MPLS, IP, NSH etc.")
Reported-by: default avatarXiang Mei <xmei5@asu.edu>
Signed-off-by: default avatarWeiming Shi <bestswngs@gmail.com>
Reviewed-by: default avatarKuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: default avatarEric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260426165350.1663137-2-bestswngs@gmail.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent dfb7e3b9

drivers/net/bareudp.c

+3 −0
Original line number Diff line number Diff line
@@ -529,6 +529,9 @@ static int bareudp_fill_metadata_dst(struct net_device *dev, 
		struct in6_addr saddr;

		struct socket *sock = rcu_dereference(bareudp->sock);



		if (!sock)

			return -ESHUTDOWN;



		dst = udp_tunnel6_dst_lookup(skb, dev, bareudp->net, sock,

					     0, &saddr, &info->key,

					     sport, bareudp->port, info->key.tos,