diff options
| author | Eric Dumazet <edumazet@google.com> | 2026-05-26 17:55:28 +0300 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2026-05-28 03:27:26 +0300 |
| commit | 507541c2a8eeb76c02bd2511958f73a8cfa3e1bc (patch) | |
| tree | 2254a172e4eedfa8c009503008443e8bb45fa1aa /include | |
| parent | 5af067bf8a64dac896f120a98fe2ca656df92562 (diff) | |
| download | linux-507541c2a8eeb76c02bd2511958f73a8cfa3e1bc.tar.xz | |
ipv6: guard against possible NULL deref in __in6_dev_stats_get()
dev_get_by_index_rcu() could return NULL if the original physical
device is unregistered.
Found by Sashiko.
Fixes: e1ae5c2ea478 ("vrf: Increment Icmp6InMsgs on the original netdev")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Stephen Suryaputra <ssuryaextr@gmail.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260526145529.3587126-2-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'include')
| -rw-r--r-- | include/net/addrconf.h | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/include/net/addrconf.h b/include/net/addrconf.h index 9e96776945e5..539bbbe54b14 100644 --- a/include/net/addrconf.h +++ b/include/net/addrconf.h @@ -369,8 +369,11 @@ static inline struct inet6_dev *__in6_dev_get_rtnl_net(const struct net_device * static inline struct inet6_dev *__in6_dev_stats_get(const struct net_device *dev, const struct sk_buff *skb) { - if (netif_is_l3_master(dev)) + if (netif_is_l3_master(dev)) { dev = dev_get_by_index_rcu(dev_net(dev), inet6_iif(skb)); + if (!dev) + return NULL; + } return __in6_dev_get(dev); } |