[PATCH net v3] ipv6: reject routes without an inet6_dev

[PATCH net v3] ipv6: reject routes without an inet6_dev

[Yingjie Wang]

ip6_route_output() and ip6_route_lookup() can return an error-free route
whose rt6i_idev is NULL.  Lowering an external nexthop device's MTU below
IPV6_MIN_MTU tears down its inet6_dev, while fib6_ifdown() leaves routes
using nexthop objects in the FIB.

An unprivileged user with CAP_NET_ADMIN in a private user and network
namespace can construct this state.  Consumers which treat a route without
an error as usable can then dereference the NULL rt6i_idev.  This was
reproduced as a KASAN NULL pointer dereference in ip6_tnl_xmit().

An audit of IPv6 route and tunnel users found this unchecked
ip6_dst_idev() dereference.

A similar missing inet6_dev check was fixed in commit 1b9b5323725e
("netfilter: ip6t_rpfilter: reject routes without inet6_dev").  However,
the route construction path still marks routes without an inet6_dev as
successful, leaving every consumer responsible for the same check.

Acquire the inet6_dev reference before initializing the destination.  If a
non-reject route has no inet6_dev, initialize it as RTN_UNREACHABLE instead
of a successful route.  Explicit reject routes keep their original type and
error.  This establishes that ordinary error-free IPv6 routes have an
inet6_dev while retaining the existing defensive checks at callers.

The modified route object builds cleanly with W=1.  A full x86_64 KASAN
bzImage build completes; it reports two pre-existing kernel-doc warnings
outside this change.

Tests:
  - `make W=1 net/ipv6/route.o`
  - full x86_64 KASAN `bzImage` build with `W=1`
  - KASAN QEMU with an unprivileged user and network namespace: after
    lowering the MTU, the stale route returned `No route to host`, a normal
    route still resolved, and the collect_md trigger completed without
    KASAN, oops, or panic
  - `tools/testing/selftests/net/ip6_tunnel.sh` in the same KASAN QEMU

Fixes: 5b98324ebe29 ("ipv6: Allow routes to use nexthop objects")
Closes: https://lore.kernel.org/netdev/DMP4WRIOGMBX.3VW2KNLBGDZ0K@gmail.com/
Suggested-by: Alexei Starovoitov <ast@kernel.org>
Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>
Cc: stable@vger.kernel.org
Signed-off-by: Yingjie Wang <1075151112@qq.com>
---
Changes since v2:
  - Use Alexei Starovoitov's V1 review as `Closes:` and drop the
    manually supplied `Link:`, as requested by Hangbin Liu.
  - Add the discovery method requested by the netdev information bot.
  - Add Hangbin Liu's `Reviewed-by:`.

v2: https://lore.kernel.org/netdev/tencent_3049FF6D9F23419F56589E244420973D2708@qq.com/

Changes since v1:
  - Move the invariant into IPv6 route construction following Alexei
    Starovoitov's review.
  - Acquire `rt6i_idev` before destination initialization and preserve the
    existing handling of explicit reject routes.
  - Update `Fixes:` to the nexthop-object route support commit.

v1: https://lore.kernel.org/netdev/tencent_CB9E1044AC97882719FF3A9F5B410A562408@qq.com/

 net/ipv6/route.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 2eb884558c24..a4c792fc55e3 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1165,6 +1165,12 @@ static void ip6_rt_init_dst(struct rt6_info *rt, const struct fib6_result *res)
 		return;
 	}
 
+	/* addrconf_ifdown() removed inet6_dev. The device can't do IPv6. */
+	if (!rt->rt6i_idev) {
+		ip6_rt_init_dst_reject(rt, RTN_UNREACHABLE);
+		return;
+	}
+
 	rt->dst.error = 0;
 	rt->dst.output = ip6_output;
 
@@ -1200,10 +1206,10 @@ static void ip6_rt_copy_init(struct rt6_info *rt, const struct fib6_result *res)
 	const struct net_device *dev = nh->fib_nh_dev;
 	struct fib6_info *f6i = res->f6i;
 
+	rt->rt6i_idev = dev ? in6_dev_get(dev) : NULL;
 	ip6_rt_init_dst(rt, res);
 
 	rt->rt6i_dst = f6i->fib6_dst;
-	rt->rt6i_idev = dev ? in6_dev_get(dev) : NULL;
 	rt->rt6i_flags = res->fib6_flags;
 	if (nh->fib_nh_gw_family) {
 		rt->rt6i_gateway = nh->fib_nh_gw6;

base-commit: 30c71476d842b094651bd7712f6c8ee8716147d0
-- 
2.43.0

Re: [PATCH net v3] ipv6: reject routes without an inet6_dev

[Ido Schimmel]

On Mon, Nov 09, 2026 at 04:29:40PM +0800, Yingjie Wang wrote:
> ip6_route_output() and ip6_route_lookup() can return an error-free route
> whose rt6i_idev is NULL.  Lowering an external nexthop device's MTU below
> IPV6_MIN_MTU tears down its inet6_dev, while fib6_ifdown() leaves routes
> using nexthop objects in the FIB.
> 
> An unprivileged user with CAP_NET_ADMIN in a private user and network
> namespace can construct this state.  Consumers which treat a route without
> an error as usable can then dereference the NULL rt6i_idev.  This was
> reproduced as a KASAN NULL pointer dereference in ip6_tnl_xmit().
> 
> An audit of IPv6 route and tunnel users found this unchecked
> ip6_dst_idev() dereference.
> 
> A similar missing inet6_dev check was fixed in commit 1b9b5323725e
> ("netfilter: ip6t_rpfilter: reject routes without inet6_dev").  However,
> the route construction path still marks routes without an inet6_dev as
> successful, leaving every consumer responsible for the same check.
> 
> Acquire the inet6_dev reference before initializing the destination.  If a
> non-reject route has no inet6_dev, initialize it as RTN_UNREACHABLE instead
> of a successful route.  Explicit reject routes keep their original type and
> error.  This establishes that ordinary error-free IPv6 routes have an
> inet6_dev while retaining the existing defensive checks at callers.
> 
> The modified route object builds cleanly with W=1.  A full x86_64 KASAN
> bzImage build completes; it reports two pre-existing kernel-doc warnings
> outside this change.
> 
> Tests:
>   - `make W=1 net/ipv6/route.o`
>   - full x86_64 KASAN `bzImage` build with `W=1`
>   - KASAN QEMU with an unprivileged user and network namespace: after
>     lowering the MTU, the stale route returned `No route to host`, a normal
>     route still resolved, and the collect_md trigger completed without
>     KASAN, oops, or panic
>   - `tools/testing/selftests/net/ip6_tunnel.sh` in the same KASAN QEMU
> 
> Fixes: 5b98324ebe29 ("ipv6: Allow routes to use nexthop objects")
> Closes: https://lore.kernel.org/netdev/DMP4WRIOGMBX.3VW2KNLBGDZ0K@gmail.com/
> Suggested-by: Alexei Starovoitov <ast@kernel.org>
> Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>
> Cc: stable@vger.kernel.org
> Signed-off-by: Yingjie Wang <1075151112@qq.com>

It makes IPv6 consistent with IPv4 in that both now return an error when
hitting such a route [1]. The error code is different, but that's fine,
so:

Reviewed-by: Ido Schimmel <idosch@nvidia.com>

[1]
ip link add name dummy1 up type dummy
ip -4 nexthop add id 1 dev dummy1
ip -6 nexthop add id 2 dev dummy1
ip -4 route add 192.0.2.0/24 nhid 1
ip -6 route add 2001:db8:1::/64 nhid 2
ip link set dev dummy1 mtu 60
ip -4 route get 192.0.2.1
RTNETLINK answers: Invalid argument
ip -6 route get 2001:db8:1::1
RTNETLINK answers: No route to host

Re: [PATCH net v3] ipv6: reject routes without an inet6_dev

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Mon,  9 Nov 2026 16:29:40 +0800 you wrote:
> ip6_route_output() and ip6_route_lookup() can return an error-free route
> whose rt6i_idev is NULL.  Lowering an external nexthop device's MTU below
> IPV6_MIN_MTU tears down its inet6_dev, while fib6_ifdown() leaves routes
> using nexthop objects in the FIB.
> 
> An unprivileged user with CAP_NET_ADMIN in a private user and network
> namespace can construct this state.  Consumers which treat a route without
> an error as usable can then dereference the NULL rt6i_idev.  This was
> reproduced as a KASAN NULL pointer dereference in ip6_tnl_xmit().
> 
> [...]

Here is the summary with links:
  - [net,v3] ipv6: reject routes without an inet6_dev
    https://git.kernel.org/netdev/net/c/08a1eb7a634f

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html